Every third party that touches data from this site
Named before you ask, with what each one actually receives rather than a category. The list includes integrations that are present in the code but switched off, because what could switch on is part of an honest answer.
- Active
- 4 subprocessors
- Notice
- 30 days
- Published since
- 2 September 2026
A subprocessor is a third party that processes data on our behalf. MetaMinds uses 10 of them in connection with this website, 4 of which are processing anything today. No analytics vendor is receiving data at the moment, and no advertising vendor is receiving any either: one is integrated and switched off, and it is listed below rather than left out.
Active today
| Subprocessor | What it is for | What it receives | Region | Status | Listed on |
|---|---|---|---|---|---|
| HetznerHetzner Online GmbH | Hosting metaminds.store. The site and its four API routes run in a single container on a server we operate. | Standard request metadata needed to serve a page: IP address, user agent, requested URL and timestamp, in the web server's own access logs. No account exists on this site, so there is nothing else to receive. Note that this is infrastructure rather than a managed platform: the operating system, the web server and the container are ours, and Hetzner supplies the machine. | Germany (eu-central) | Active | Objection window to 11 October 2026 |
| BrevoSendinblue SAS (trading as Brevo), France | Delivering enquiry-form submissions to our inbox, and sending you the confirmation that we received it. | The contents of an enquiry you choose to send: name, work email, company, role, country, VAT status, the engagement you selected, and what you wrote in the free-text field. Nothing is sent unless you submit the form. It also holds a log of the message so we can show that it was delivered. | France and Germany. EU only, with no transfer outside the EEA. | Active | Objection window to 12 October 2026 |
| RazorpayRazorpay Software Private Limited, India | Taking payment for the instant-download products, and telling our server when a payment succeeded or was refunded so the download can be released or withdrawn. | What you enter on Razorpay's own hosted payment page, which we never see: your payment instrument and whatever billing detail it requires. We receive back only the email address you buy with, the amount, the currency, the product reference and Razorpay's own payment and event identifiers. No card number, CVV or expiry ever reaches this site. | India. Buying from the EU, the UK or the US means your payment data is processed in India, which is a transfer outside the EEA; the basis is stated on /legal/dpa. | Active | Objection window to 2 November 2026 |
| AnthropicAnthropic PBC | The on-site assistant. Generates replies to questions you type into it. | The messages you type into the assistant panel, plus our own system prompt. Nothing else on the page is sent, no identifier travels with it, and the conversation is not written to any store on our side. | United States | Active | Objection window to 2 October 2026 |
Present in the code, receiving nothing
These are integrated but not switched on. They receive no data in their current state. They are listed because switching one on is a configuration change rather than a code change, and you are entitled to know that before it happens rather than after.
| Subprocessor | What it is for | What it receives | Region | Status | Listed on |
|---|---|---|---|---|---|
| VercelVercel Inc. | Formerly hosting and content delivery for metaminds.store. Retired 11 September 2026 when hosting moved to a server we operate. | While active: standard request metadata needed to serve a page, held in the platform's own operational logs. No account existed on this site, so there was nothing else to receive. | Not determined while active | Retired, no longer receives anything | Objection window to 2 October 2026 |
| ResendPlus Five Five, Inc. | Formerly intended for delivering enquiry-form submissions. Replaced by Brevo on 12 September 2026, having never been activated. | Nothing, ever. The integration was in the code but its API key was never set and its domain authentication was never completed, so no message was ever accepted by it and no enquiry ever reached it. | United States | Retired, no longer receives anything | Objection window to 2 October 2026 |
| Cloudflare Web AnalyticsCloudflare, Inc. | Formerly planned for cookieless page-view counting. Withdrawn 12 September 2026 without ever being activated, in favor of a counter running on our own server. | Nothing, ever. The integration sat in the code with its beacon token unset from the day the site launched until the day it was disabled, so no beacon was loaded and no request reached Cloudflare at any point. | Not applicable; never activated | Retired, no longer receives anything | Objection window to 2 October 2026 |
| GoogleGoogle Ireland Limited | Scheduling a call, if a booking page is adopted. Google Calendar creates the appointment and the Google Meet link. | What you type into the booking page: your name, your email address and the slot you pick, plus anything you add in the notes field. Booking is entirely optional and nothing is sent unless you complete it. If you would rather not use it, the enquiry form and the published email address reach the same person. | European Union, and Google's global infrastructure | Planned, not configured | Objection window to 11 October 2026 |
| Plausible AnalyticsPlausible Insights OU, Estonia | Cookieless analytics with conversion goals, if adopted in place of the above. | Nothing today. Recorded as disabled in our tool registry, so the script does not load. | European Union | Planned, not configured | Objection window to 2 October 2026 |
| LinkedIn Insight TagLinkedIn Ireland Unlimited Company | Measuring which LinkedIn campaigns produce enquiries, and building retargeting audiences, if LinkedIn advertising is ever run. | Nothing today. It is recorded as disabled in our tool registry and no partner ID is set, so the script does not load and no request reaches LinkedIn. Unlike everything else on this list it sets third-party cookies, so it is the one tool that would make a consent banner appear before it could run at all. | Ireland, and LinkedIn's global infrastructure | Planned, not configured | Objection window to 5 October 2026 |
Changing this list
We give 30 days’ notice before a new subprocessor starts processing data covered by a signed DPA, so there is time to object. This page is the canonical list and is updated on the day a change takes effect, not in the following quarter.
Each row shows the date it was first listed here and the date its objection window closes, so the 30 day period can be checked rather than taken on trust. To be clear about the earliest ones: this list was first published on , when no signed DPA was in force, so those dates record when the entry appeared and are not a notice served on any controller. Anything added after a DPA is signed is a notice, and the window on that row is the one that counts.
Subprocessors used inside a paid engagement are not pre-committed here. They depend on where your system runs, and they are named in that engagement’s architecture document before work starts. Where we build inside your own tenancy, there is usually no subprocessor of ours in the path at all.
Questions about anything on this page go to help@metaminds.store and are answered by a person. The cookie policy covers what is stored on your own device, which is a different question, and it is here.
Subprocessors, answered directly.
Every answer here is the same string this page puts in its structured data, so a person and an answer engine read the identical text. Open one to read it.
Where is data from this site processed?
The site itself runs on a server MetaMinds operates at Hetzner in Germany, eu-central, in a single container. Every other third party that touches data from this site is named on this page with its own processing region, its purpose, and what it actually receives. Where a region has not been determined, the row says so rather than guessing at one.
Does MetaMinds publish subprocessors that are not switched on yet?
Yes, and that is the unusual part of this list. Tools that are wired into the code but not activated appear here marked as planned, and tools that were once configured and are no longer used appear marked as retired rather than being deleted. A list that only shows what is live cannot answer the question a reviewer actually has, which is who held data and when.
Does the on-site AI assistant send my messages to a third party?
Yes, to Anthropic in the United States, which is named on this page as an active subprocessor with that purpose stated: it generates the replies to questions typed into the assistant. The API key is server-side only and the assistant renders at all only when it is configured, so an unconfigured deployment shows no launcher rather than a broken one.
How is a new subprocessor authorized and notified?
Through a general written authorization under GDPR Article 28(4), which operates on the CATEGORIES set out in Annex B of the data processing addendum, with this page carrying the current named list within those categories. A controller objecting to a named addition has the objection window the addendum states. The two documents are distinct and both are needed, and treating the published page as the authorization itself is a common and consequential error.
Does this site set analytics or marketing cookies?
No analytics or marketing cookie is set today. The analytics that is wired is cookieless, and the consent banner shows nothing while every enabled tool stores nothing on the device. The cookie policy names each tool, what it stores and for how long, rather than describing categories in the abstract.
Questions about any of this
Data protection questions, and any request to see, correct or delete what we hold, go to help@metaminds.store. Anything else, including a markup of these documents from your own counsel, goes to help@metaminds.store.
The answers your security team will ask for, including the subprocessor list with every region, are on the security posture page.