Legal & privacy
Service providers and data locations
Infrastructure, customer services and optional integrations with their respective data scope.
Last updated: 11 October 2026
Status of this overview
This list distinguishes processors providing wayfold’s technical infrastructure, providers for our own business operations and services customers connect separately. Enabled functions determine the data involved. Visitor sessions are not sent to Google or Stripe for billing, advertising or training external AI models.
Hosting, network and backups
Hetzner Online GmbH, Industriestrasse 25, 91710 Gunzenhausen, Germany: application and collection server hosting in Germany. Processing covers request and application data needed for transmission and service delivery. Hetzner is an infrastructure processor. Supabase separately provides the database service and its backups. Transport services necessarily process IP addresses; the wayfold analytics database does not store raw visitor IP addresses.
Supabase: database, authentication and files
Supabase Pte. Ltd., Singapore: database, customer authentication and private file storage. The primary production region is Zurich, Switzerland (AWS eu-central-2). Data includes limited analytics, workspace and account data and private profile images. According to Supabase’s location documentation, database backups also stay in the selected region. Supabase Inc., United States, and further subprocessors named in Supabase’s list support operations. Support access may occur outside Switzerland; this is not a promise of exclusively Swiss processing. Supabase’s data processing agreement, transfer safeguards and published subprocessor list govern its services. Links are provided under “Further privacy information”.
Email delivery
Sign-in and recovery messages are processed through Supabase Auth. This involves the recipient address and message content needed for the requested access; visitor events are not included. The currently configured Supabase default mail service is restricted and does not promise delivery to arbitrary recipients. The address support@wayfold.ch is the direct contact for support and privacy requests.
Stripe: payments
Stripe and, for checkout flows labelled accordingly, Sold through Link, LLC (United States) process order, contact, billing and payment data. Stripe/Link act as independent controllers for payment, tax and fraud-prevention purposes; they are not subprocessors for our visitor analytics. Other responsible Stripe entities and transfers depend on the country and payment service and are described in the linked Stripe/Link notices. wayfold receives limited customer, subscription and payment references and status information, not full card details. Visitor sessions are not transmitted.
Google: customer-selected connections
Google Ireland Limited, Ireland, and Google LLC, United States: optional Google sign-in, Google Search Console and Google Analytics 4. Google sign-in provides the authorised account details needed for authentication and the profile, where Google sign-in is enabled. Search Console and GA4 require separate authorisation by an authorised customer. They provide search statistics or aggregated daily values; GA user and client IDs are not imported. GA4 CSV imports do not require a Google connection. Integration tokens remain encrypted on the server. Connections can be disconnected in website settings, and permissions can also be revoked in the Google account. Disconnecting stops further retrievals but does not automatically delete previously imported statistics. Google describes its own processing and international transfers in its privacy information.
Changes and questions
Infrastructure subprocessor changes follow the data processing agreement’s procedure, including 30 days’ advance notice and an opportunity to object. Changes to a customer-selected integration are additionally governed by that customer’s agreement with the provider. Questions and requests about transfer safeguards: support@wayfold.ch.