Sub-processors
Every company that holds or handles personal data on our behalf, what each one handles, and where. Plus the ones nobody sends anything to but your own browser talks to anyway, because leaving those off would be the more convenient kind of honest.
This document is a draft. It was written from what Leaves actually does rather than from a template, but it has not been reviewed or approved by anybody with legal responsibility, and nothing on this page binds you or us until it has been. Billing is not open, so nobody has been asked to agree to it either.
01 What this list is §
A sub-processor is a company that holds or handles personal data on our behalf so that Leaves can run. Every one of them is below, with what it handles and where it is.
The entries that have not been contracted yet say so rather than naming something plausible. They are among the reasons billing cannot open.
Under that list is a second one, of parties nobody sends anything to but whose servers your browser reaches because a page asked it to. They are not sub-processors and calling them that would be wrong. Leaving them out would be worse: from where you are sitting, a third party learning your address is a third party learning your address.
02 Sub-processors §
Hosting — provider not yet chosen
Not contracted yet
- Handles
- Everything: the application, the API, the database, and every file you upload. This is the single most consequential name on the page and it is the one that is missing.
- Where
- The Netherlands. The provider is one of two Dutch candidates and the choice has not been made.
- Since
- Not yet
Cloudflare, Inc.
- Handles
- The address and request details of a browser reading these public pages. It serves this site and answers DNS for the domain. It is not in front of the application, the API or the database, and it never sees a record.
- Where
- United States, served from machines near the reader. The one party on this page outside the European Union.
- Since
- 2026-09-10
Plausible Insights OÜ
- Handles
- Anonymous page views, referrers, countries, the two public calls-to-action and the two application conversion events. No names, email addresses, project content, cookies or persistent identifiers.
- Where
- Estonia, with visitor data processed and stored in the European Union.
- Since
- 2026-09-11
Mollie B.V.
Not live yet
- Handles
- Your name, your email address, the amount, the term and the payment method you pick, together with the identifiers it returns to us. Card and bank details are entered on Mollie's own page and never touch our systems.
- Where
- Amsterdam, the Netherlands.
- Since
- Not yet
Transactional mail — provider not yet chosen
Not contracted yet
- Handles
- The address a message is sent to and the message itself: registration confirmations, project invitations, email-change confirmations and password resets. Today the application's own server sends these and no third party is involved at all.
- Where
- Undecided. A provider will be listed here before it sends anything.
- Since
- Not yet
Komoot GmbH
- Handles
- The words you type into a place field, when you use address lookup. Our server makes that request rather than your browser, so what reaches Photon is the text and our server's address — not yours.
- Where
- Germany.
- Since
- 2026-06-01
03 Third parties your browser reaches §
Neither of these is sent anything by us. Both are contacted directly by your own browser because a page references a file on their servers, which is enough for them to see the address you are reading from.
Google Ireland Limited — Google Fonts
- Sees
- Your address and browser, each time it serves the three typefaces this site and the application are set in.
- Where
- Ireland, from servers worldwide.
- Why it is here
- Because the fonts are linked rather than served from our own domain. Serving them ourselves removes this entry completely, and that is written down as work to do rather than as a consideration.
OpenStreetMap Foundation
- Sees
- Your address, and which map squares were requested — which is to say, roughly which place you are looking at.
- Where
- United Kingdom and the European Union.
- Why it is here
- Map tiles, and only on a screen showing a place that has coordinates. No map, no request.
04 What we do not use §
Three things people reasonably assume are on a list like this, and are not.
- Analytics
- Plausible Analytics only. It records anonymous page views, referrers, countries, the two public calls-to-action and the two application conversion events; it does not record feature usage, sessions or heatmaps. It sets no cookies and creates no persistent identifiers.
- Error tracking
- None. When something breaks it is read out of our own server's logs.
- Advertising
- None, anywhere, in any form. No pixels, no remarketing, and nothing sold or shared for it.
- Model training
- Your research is not used to train any model, ours or anybody else's, and it is not handed to anyone who might.
05 How this list changes §
A new sub-processor appears here before it starts processing anything, with the date it starts. Where the change is material — a new place your research is stored, a new party that can see it — account holders are told by email as well as on this page.
The date at the top is the date this list last changed.