Subprocessor List
Last updated: 5 November 2026
Eachlang (Senem Can) uses the following third parties to process Customer Personal Data as described in our Data Processing Agreement. We notify subscribed customers at least 30 days before adding or replacing a subprocessor. To be added to the update list, email privacy@eachlang.com.
TR standard contract (KVKK Art. 9): "Yes" with dates means we have signed the standard contract announced by Türkiye's Personal Data Protection Board with that provider (signature date) and notified it to the Personal Data Protection Authority (notification date). "No" means we have not signed such a contract with that provider, and our relationship with it relies on the provider's own data processing terms, as described in Section 5 of our Privacy Policy.
1. Subprocessors (process customer website data)
| Subprocessor | Purpose | Data processed | Location | Transfer safeguard | TR standard contract (KVKK Art. 9) |
|---|---|---|---|---|---|
| Cloudflare, Inc. | Edge network that serves translated pages (Workers), custom hostnames and TLS certificates (Cloudflare for SaaS), cache and translation-memory storage (KV, D1, R2), job queues | Visitor request data (IP, URL, headers); website text and translations; cached pages | Global edge network; storage location European Union where Cloudflare offers EU jurisdiction for the product, otherwise global | Cloudflare DPA with SCCs; EU-U.S. Data Privacy Framework | No |
| OpenRouter, Inc. | Routes machine-translation requests to the AI model providers below | Text segments from website content, which may contain personal data present on the site; no visitor data | United States | OpenRouter's terms and data policy; under its published data policy, OpenRouter does not store prompts or responses unless prompt logging is turned on; we do not turn it on, and we do not allow OpenRouter to use our data to improve its product. Every request we send also asks OpenRouter to route it only to providers that, under OpenRouter's provider data policies, do not collect user data. Request metadata such as token counts is kept | No |
| Anthropic, PBC (Claude models, reached through OpenRouter) | Machine translation of website text (primary model) | As above | United States | Requests are routed only to Anthropic's own endpoint; under the provider's published API data policy, inputs are not used to train models; inputs may be kept for a limited period to prevent abuse | No |
| OpenAI, L.L.C. (GPT models, reached through OpenRouter) | Fallback machine translation, used only when the primary model is unavailable | As above | United States | Requests are routed only to OpenAI's own endpoint; under the provider's published API data policy, inputs are not used to train models; abuse-monitoring logs may be kept for a limited period | No |
| Supabase, Inc. | Product database: projects, settings, invited users, glossaries | Account and project data of invited users; glossary entries | European Union (Frankfurt); underlying cloud provider Amazon Web Services | Supabase DPA with SCCs | No |
2. Service providers for our own operations (account, support, analytics)
These providers process data for which we are the controller (see our Privacy Policy). They are listed here for transparency.
| Provider | Purpose | Data | Location | Status | TR standard contract (KVKK Art. 9) |
|---|---|---|---|---|---|
| Supabase, Inc. | Accounts, authentication, product event log | Account data; usage events, including how you found us (campaign tags, referring site) | EU (Frankfurt) | Planned for account features | No |
| Cloudflare, Inc. (Cloudflare Web Analytics) | Marketing-site visit statistics, cookieless | Aggregated page views, referrer, country | Global edge network | In use for our marketing website; covered by the Cloudflare DPA (Section 1) | No |
3. Independent controllers (not subprocessors)
| Company | Role | More information |
|---|---|---|
| Paddle.com Market Limited and its affiliates | Merchant of Record: checkout, payment processing, invoicing, sales tax/VAT, refunds, fraud screening | https://www.paddle.com/legal/privacy |
4. Change log
| Date | Change |
|---|---|
| 4 November 2026 | Initial list |
| 5 November 2026 | AI translation: OpenRouter, Inc. added, with Anthropic, PBC as primary and OpenAI, L.L.C. as fallback model provider; Google LLC (Gemini API) removed. Marketing-site analytics: Cloudflare Web Analytics. |
Questions about this page? Write to hello@eachlang.com.