Every third party that touches data from this site
Named before you ask, with what each one actually receives rather than a category. The list includes integrations that are present in the code but switched off, because what could switch on is part of an honest answer.
A subprocessor is a third party that processes data on our behalf. MetaMinds uses 7 of them in connection with this website, 3 of which are processing anything today. No analytics vendor is receiving data at the moment, and no advertising vendor is receiving any either: one is integrated and switched off, and it is listed below rather than left out.
Active today
| Subprocessor | What it is for | What it receives | Region | Status | Listed on |
|---|---|---|---|---|---|
| HetznerHetzner Online GmbH | Hosting metaminds.store. The site and its four API routes run in a single container on a server we operate. | Standard request metadata needed to serve a page: IP address, user agent, requested URL and timestamp, in the web server's own access logs. No account exists on this site, so there is nothing else to receive. Note that this is infrastructure rather than a managed platform: the operating system, the web server and the container are ours, and Hetzner supplies the machine. | Germany (eu-central) | Active | Objection window to 11 October 2026 |
| ResendPlus Five Five, Inc. | Delivering enquiry-form submissions to our inbox. | The contents of an enquiry you choose to send: name, work email, company, role, country, VAT status, the engagement you selected, and what you wrote in the free-text field. Nothing is sent unless you submit the form. | United States | Active | Objection window to 2 October 2026 |
| AnthropicAnthropic PBC | The on-site assistant. Generates replies to questions you type into it. | The messages you type into the assistant panel, plus our own system prompt. Nothing else on the page is sent, no identifier travels with it, and the conversation is not written to any store on our side. | United States | Active | Objection window to 2 October 2026 |
Present in the code, receiving nothing
These are integrated but not switched on. They receive no data in their current state. They are listed because switching one on is a configuration change rather than a code change, and you are entitled to know that before it happens rather than after.
| Subprocessor | What it is for | What it receives | Region | Status | Listed on |
|---|---|---|---|---|---|
| VercelVercel Inc. | Formerly hosting and content delivery for metaminds.store. Retired 11 September 2026 when hosting moved to a server we operate. | While active: standard request metadata needed to serve a page, held in the platform's own operational logs. No account existed on this site, so there was nothing else to receive. | Not determined while active | Retired, no longer receives anything | Objection window to 2 October 2026 |
| Cloudflare Web AnalyticsCloudflare, Inc. | Cookieless page-view counting. | Nothing today. The integration is present in the code but the beacon token has never been set, so no beacon is loaded and no request reaches Cloudflare. When it is set, it receives page URL, referrer and coarse device class, with no cookie and no cross-site identifier. | Global edge network | Wired, switched off | Objection window to 2 October 2026 |
| Plausible AnalyticsPlausible Insights OU, Estonia | Cookieless analytics with conversion goals, if adopted in place of the above. | Nothing today. Recorded as disabled in our tool registry, so the script does not load. | European Union | Planned, not configured | Objection window to 2 October 2026 |
| LinkedIn Insight TagLinkedIn Ireland Unlimited Company | Measuring which LinkedIn campaigns produce enquiries, and building retargeting audiences, if LinkedIn advertising is ever run. | Nothing today. It is recorded as disabled in our tool registry and no partner ID is set, so the script does not load and no request reaches LinkedIn. Unlike everything else on this list it sets third-party cookies, so it is the one tool that would make a consent banner appear before it could run at all. | Ireland, and LinkedIn's global infrastructure | Planned, not configured | Objection window to 5 October 2026 |
Changing this list
We give 30 days’ notice before a new subprocessor starts processing data covered by a signed DPA, so there is time to object. This page is the canonical list and is updated on the day a change takes effect, not in the following quarter.
Each row shows the date it was first listed here and the date its objection window closes, so the 30 day period can be checked rather than taken on trust. To be clear about the earliest ones: this list was first published on , when no signed DPA was in force, so those dates record when the entry appeared and are not a notice served on any controller. Anything added after a DPA is signed is a notice, and the window on that row is the one that counts.
Where an upstream provider gives us less warning than we give you, we pass it on as soon as we have it and the shorter period governs (Resend commits to 14 days). MetaMinds cannot commit on a vendor's behalf to a notice period the vendor does not offer.
Subprocessors used inside a paid engagement are not pre-committed here. They depend on where your system runs, and they are named in that engagement’s architecture document before work starts. Where we build inside your own tenancy, there is usually no subprocessor of ours in the path at all.
Questions about anything on this page go to privacy@metaminds.store and are answered by a person. The cookie policy covers what is stored on your own device, which is a different question, and it is here.
Questions about any of this
Data protection questions, and any request to see, correct or delete what we hold, go to privacy@metaminds.store. Anything else, including a markup of these documents from your own counsel, goes to hello@metaminds.store.
The answers your security team will ask for, including the attestations we do not hold, are on the security posture page.