LoginLlama runs on its own servers in the United Kingdom. The database, the cache and every login you send to the API live there. These are the outside companies that also handle personal data for us.

Company	What for	What it gets	Where
Cloudflare	DNS, the tunnel that carries traffic to our servers, and the firewall in front of them. Also forwards email sent to @loginllama.app addresses.	Every request to the site and the API passes through it, including IP addresses, request headers and request bodies. Email sent to us.	United StatesEU-US Data Privacy Framework and its UK extension, or Standard Contractual Clauses
Resend	Sends email: sign-in and account email, login alerts, and product email. Resend delivers through Amazon SES.	Recipient email address and the content of the email. A login alert includes the time, location, browser and a small map of the login.	United StatesEU-US Data Privacy Framework and its UK extension, or Standard Contractual Clauses
Stripe	Takes payments and runs subscriptions.Only for customers on a paid plan.	Billing name, email address, address and payment details. Stripe holds the card; we never see the full number.	United StatesEU-US Data Privacy Framework and its UK extension, or Standard Contractual Clauses
Sentry	Error reports from the server and the browser, so we can fix faults.	Error details, the URL, browser and device, and the account id where there is one. Session replays of 10% of browser sessions and of every session with an error, with all text masked and all images blocked.	United StatesEU-US Data Privacy Framework and its UK extension, or Standard Contractual Clauses
Google Analytics	Counts visits to the website and the steps from sign-up to payment.	Pages viewed, referrer, browser, device, approximate location and a cookie id. For sign-up and billing events sent from our server, the account id.	United StatesEU-US Data Privacy Framework and its UK extension, or Standard Contractual Clauses
Google Fonts	Serves the Inter font used on the site.	The visitor's IP address and browser, when the browser fetches the font.	United StatesEU-US Data Privacy Framework and its UK extension, or Standard Contractual Clauses
CARTO	Serves the map tiles on the dashboard login map.	The dashboard user's IP address and browser, and the map area in view.	United StatesStandard Contractual Clauses
OpenStreetMap Foundation	Map tiles for the small map in login alert email.	Our server fetches tiles for the area around a login (about city level). No IP address, email address or identity goes with the request.	United KingdomAdequacy decision (UK to EEA and EEA to UK)
Team Cymru	Network owner lookup for the free IP lookup tool.Only when someone uses the IP lookup tool. API login checks use a local database and send nothing.	The IP address a visitor types into the tool, sent as a DNS query.	United StatesStandard Contractual Clauses

The code also supports these, but we do not switch them on. We will add one to the table above before we do: Ahrefs analytics; Crisp chat; LogSnag; PostHog.

We give at least 30 days' notice before we add a subprocessor that handles login data you send to the API. We update this page and email the owner of each account. You can object by writing to [email protected].

See the privacy policy for how we use this data, and the data processing terms for what we promise as your processor.

Subprocessors