Last updated: 25 October 2026
Sub-processors
The third parties that process data for SQL Optimizer, what each one sees, and where it processes it.
Why this list exists
We use a small number of service providers. Each one is a sub-processor in the sense of Article 28 of the GDPR, and each is bound by a data processing agreement that limits it to processing on our instructions.
Current sub-processors
| Provider | Purpose | Data it can see | Processing location |
|---|---|---|---|
| Neon | PostgreSQL hosting, backups | Account records, usage counters, order metadata | European Union, eu-central-1 |
| Vercel | Application hosting, CDN, function logs | Request metadata; request bodies are not logged | European Union, fra1 |
| DeepSeek | Model inference for the optimization | The SQL you submit, plus any schema or execution plan you include | Mainland China |
| Sign-in (OAuth) | Name, email address, profile picture, account identifier | Global | |
| Waffo | Merchant of record: payments, tax, invoicing | Name, email, billing address, card data (we never see it) | Per Waffo's infrastructure |
| Resend | Transactional email | Email address and the content of service emails | United States |
| Google Analytics | Analytics, only with consent | Page views, device and browser data, approximate location | Global |
| Microsoft Clarity | Session analytics, only with consent | Masked session replays, page views | Global |
The one that matters most
DeepSeek processes in mainland China. The rest of the account data stays in the European Union, so this is the only transfer of your content outside it. It is covered by the Standard Contractual Clauses and a transfer impact assessment, and the payload is limited to the statement plus whatever optional context you include. The Privacy Policy explains this in full, including what to do if you would rather not transfer your statement.
Changes to this list
We will post any addition or replacement here at least 30 days before it takes effect. If you have a paid plan and object to a new sub-processor on data protection grounds, email support@sqloptimizer.online within those 30 days: we will discuss it, and if we cannot resolve it you may cancel and receive a refund for the unused part of the period.
Emergency replacements, for example when a provider fails or terminates service, may happen sooner; we will notify you as soon as practicable afterwards.
Contact
support@sqloptimizer.online.