Subprocessors
Everyone who touches your data on the Operator's behalf, what they hold, where they are, and what happens if you would rather they did not.
Who processes on the Operator's behalf
| Who | What reaches them | Where | Role | Status | If you object |
|---|---|---|---|---|---|
| Hetzner Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (Registergericht Ansbach, HRB 6089) | Hosting, compute, object storage and encrypted backups: the servers, the database, the private buckets holding screenshots and recordings, and the daily encrypted database backup | Germany, EU | Processor | In use | There is no version of this product that runs somewhere else, so objecting means closing the account. Write to the Operator and everything held for you is deleted. |
| Seznam.cz (Email Profi) Seznam.cz, a.s., Radlická 3294/10, 150 00 Praha 5 – Smíchov, Czech Republic (IČO 26168685, Městský soud v Praze, oddíl B, vložka 6493) | Transactional email, account access links and the notifications you asked for: sign-in links, alerts with the failure screenshot attached, recipient confirmations and summaries | Czech Republic, EU | Processor | In use | Objecting means the Service cannot send you an alert, which is the product. Write to the Operator and it is talked through before you decide. |
| GitHub GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, United States | Optional sign-in only: your email address, name, avatar and the connection tokens. Nothing from your projects | United States, outside the EU | Processor | Not in use yet | Sign in with a link instead and nothing of yours ever reaches them. Already linked? Write to the Operator and the link is removed. |
| OpenRouter OpenRouter, Inc., 169 Madison Avenue, New York, NY 10016, United States | Routes the two model requests to the explicitly allowed inference provider. The request passes through it, so it is a data path and not the end of the chain | United States (routing layer). The inference endpoint is in the model chain below | Processor | In use | Ask the Operator to opt your account out of the visual fallback and no screenshot of yours is ever sent. Suggested checks are only asked for once, when you add a project, and you can write your own instead. |
| Stripe Stripe Payments Europe, Limited, Dublin, Ireland (contracting and data processing entity), together with Stripe Technology Europe, Limited, Dublin, Ireland, where regulated payment services apply | Subscription billing, payment processing and tax-related billing data: your email address, the identifiers of your customer record and subscription, and the billing details you enter on Stripe's own pages. No project, check, screenshot, credential or visitor-error content | Ireland, EU (contracting entity). Stripe group companies may process outside the EU under Stripe's own data processing terms | Processor; independent controller for its own payment, fraud and regulatory processing | In use | Paying is what keeps the account open, so objecting means closing it. Write to the Operator and everything held for you is deleted; Stripe keeps what its own legal obligations require. |
| UptimeRobot UptimeRobot s. r. o., Obchodná 507/2, 811 06 Bratislava, Slovak Republic (Registration No. 561 73 067) | External availability checks of stillworks.watch itself and the public status page. It asks whether this site answers; it never sees a watched site, a check or a screenshot | Slovak Republic, EU | Processor | In use | They are asked whether this site answers, and nothing of yours is part of the question. Write to the Operator if you would rather somebody else were asked. |
GitHub says not in use yet because this installation is not configured to reach them at all, so nothing of yours does. They are named anyway, because finding out about a processor after the fact is worse than reading about one early.
Stripe is the one row with two roles. For the subscription records it keeps for the Operator it is a processor; for the payment itself, fraud prevention, anti-money-laundering checks and its own regulatory duties it is an independent controller under its own privacy policy. It never receives a project, a check, a screenshot, a credential or a visitor error.
The chain to the model
Three parties, in the order the request meets them: the router, the company running the model, and the company that built it. OpenRouter passes the request on, so naming it and stopping would tell you almost nothing; naming only the final endpoint would hide that the routing layer is in the United States.
1. Router and data path
- OpenRouter, Inc., 169 Madison Avenue, New York, NY 10016, United States
- Receives the request and forwards it to the pinned provider below. Prompt and completion logging is switched off in the OpenRouter account privacy settings; verified by the operator on 2026-09-01.
2. Inference provider and data path
azure/eu- Microsoft Azure, Azure (EU) regional endpoint operated by Microsoft — an EU region; this is the party that receives the content of the request
3. Model developer
- Finding an element again
- openai —
openai/gpt-5.6-luna
The developer is named because you should know whose model reads your page. It is informational: where the pinned endpoint is operated by another company, the developer is not the party that receives the request and is not listed as a recipient of your data.
What residency this adds up to today: every pinned provider is an EU region, so inference happens in the EU; the request still passes through OpenRouter in the United States, so the complete path is not described as EU-only. Security says what is sent in each of the two calls.
What every request carries
- A fixed list of providers
- The request may only be handled by a provider on the pinned list. Automatic routing is never used, because with it nobody could say truthfully who processed anything.
- No fallback
- If the pinned provider cannot take the request, the request fails. It is never quietly handed to somebody else.
- No retention, no training
- Every request instructs the provider not to keep the content of it and not to use it for training, and requires an endpoint that commits to zero retention.
- No logging at the router
- Prompt and completion logging is switched off on the OpenRouter account, so the router keeps no copy of the request either. There is no individual written zero-retention letter from OpenRouter or from the inference provider; the Operator relies on their published commitments and on the request-level instructions above, and reviews those commitments before each deployment.
Objecting to a model provider is the same objection as to OpenRouter, and has the same answer: ask the Operator to opt your account out of the visual fallback, and write your own checks instead of asking for suggestions.
Places you send data yourself
These are not processors of the Operator. You switch each one on, one at a time, and nothing leaves until the destination has confirmed it wants the messages.
- Slack
- The text of an alert, to a channel you connect
- Discord
- The text of an alert, to a channel you connect
- Your own webhook
- A signed message, to an endpoint you own
Deliberately not on this list
Each of these was considered and each is deliberately absent, so that nobody adds them later for completeness.
- IANA and the domain registries
- A certificate and domain check asks a registry about a domain name it already holds. No middleman is used, on purpose
- Let's Encrypt
- Issues the certificate for this site. It gets the operator's own address, nothing of yours
- The container registry
- Holds the source and the built images. No customer data is stored there
- Neko (the remote browser)
- The program that would show you the browser doing your recording. Open-source software built into an image of ours and run on our own machines, so no other company is involved. Not deployed yet
- coturn (the media relay)
- Carries the picture and your clicks when a direct connection between your browser and ours cannot be made. It is our own relay on our own machine, not somebody else's service. Not deployed yet
There is no content delivery network in front of this site, and no analytics on it about the people who read it. The one measurement the Operator does keep is about its own work: while you record a check, the Operator measures the quality of its own connection to your browser. It stays with the Operator, in the same database as the rest of your account, so it adds nobody to the list above.
Objecting, and being told first
Write to legal@stillworks.watch and say which one. You will be told what stops working, and if there is no way round it you may end the agreement and everything held for you is deleted.
Before a new processor starts handling your data you are told by email, not afterwards, and you may object before the change takes effect. The data processing agreement is where that promise is written down.