Sub-processors
Operated by Ebenworks Systems (Pvt) Ltd · accounts.ebstar.co · Last updated 22 July 2026
To run Ebenworks Accounts — the central account, identity, subscription and billing system for the Ebenworks family of products — Ebenworks Systems (Pvt) Ltd engages a small number of trusted third-party service providers (“sub-processors”) that process personal data on our behalf and under our instructions. This page lists them, why we use each, the categories of data involved, and where processing takes place.
This register covers only the central account system. Each individual product may engage additional sub-processors for data it processes within that product, disclosed under its own notice. Read alongside our Privacy Policy.
Current sub-processors
| Provider | Purpose | Data categories | Location |
|---|---|---|---|
| Neon | Managed PostgreSQL — the primary account, identity, subscription & billing database. | Account identity, organisations, subscriptions, payment records, audit logs. | United States / EU (per-project region; identity-residency configurable). |
| Vercel | Application hosting, edge routing and request/serverless compute. | All request data in transit; operational logs (IP, timestamps, user-agent). | United States / global edge. |
| Cloudflare (R2) | Object storage for user-uploaded profile images, served through an authenticated proxy. | Profile avatar images. | Global (S3-compatible object storage). |
| Resend | Transactional and lifecycle email delivery (sign-in links, one-time codes, receipts, notices). | Email address, display name, message content. | United States. |
| Stripe | Payment processing and subscription billing (primary gateway, all currencies). | Payment status and records; card details are entered directly with Stripe and never reach us. | United States / global. |
| Paystack | Payment processing for ZAR (South African rand) transactions. | Payment status and records; card details are entered directly with Paystack. | South Africa / global. |
| Optional “Continue with Google” sign-in (OAuth). | Basic profile shared at sign-in: email, name, profile picture. | United States / global. | |
| cron-job.org | External scheduler that triggers our maintenance jobs (subscription renewals sweep, reminders). | No personal data — sends authenticated triggers to our own endpoints. | European Union (Germany). |
International transfers
Some sub-processors are located outside your country. Where required (for example under the GDPR, UK GDPR, South Africa’s POPIA or Korea’s PIPA), such transfers are protected by appropriate safeguards — for instance Standard Contractual Clauses or the provider’s equivalent data-transfer mechanism — and each provider is bound by a data-processing agreement.
Changes to this list
We keep this page current. If we add or replace a sub-processor that handles personal data, we will update this register. Business customers who require advance notice of changes can request it at privacy@ebstar.co.
Data-processing agreements
If you are a business, clinic, label, or public-sector customer and need a signed Data Processing Agreement (DPA) or a copy of our sub-processor commitments, contact legal@ebstar.co.
Privacy · Terms · Acceptable Use · Refunds · Sub-processors · Security · Sign in
Privacy requests: privacy@ebstar.co · Legal: legal@ebstar.co