Sub-Processor List
Orbirank uses a limited number of trusted third-party service providers ("sub-processors") to deliver the platform. Each sub-processor is contractually bound to process personal data only for the purpose of providing services to Orbirank and in accordance with applicable data protection law (including EU Standard Contractual Clauses where required for cross-border transfers).
We do not sell personal data. We do not share personal data for advertising purposes. This list is reviewed and updated when sub-processors are added, changed, or removed. Customers are notified of material changes as described in the Privacy Policy and Terms of Service.
Current Sub-Processors
- Role
- Primary AI content generation and analysis via the Google Gemini API (Vertex AI); Google Search Console API integration (via customer OAuth authorisation).
- Data processed
- Content and prompts submitted to AI features; Google Search Console performance data (queries, clicks, impressions, rankings) where you have granted OAuth access.
- Transfer mechanism
- EU Standard Contractual Clauses (Commission Decision (EU) 2021/914).
- Location
- United States of America (and other Google infrastructure regions).
- Privacy information
- Google Privacy Policy · Gemini API Terms
- Role
- AI/LLM processing sub-processor. Orbirank may use Anthropic's Claude API for AI content generation, analysis, and related features. Google Gemini (listed above) is the primary AI provider; Anthropic may be used alongside it.
- Data processed
- Content and prompts submitted to AI features where Anthropic services are invoked.
- Transfer mechanism
- EU Standard Contractual Clauses (where applicable).
- Location
- United States of America.
- Privacy information
- Anthropic Privacy Policy · Anthropic Usage Policy
- Role
- Merchant of Record for all Orbirank purchases globally. Handles billing, payment processing, subscription management, VAT/GST collection and remittance, and invoicing. When you purchase a subscription, your billing contract is with Paddle, not directly with N.S. IT SERVICES PTY LTD.
- Data processed
- Name, email address, billing address, payment method details (card numbers are held by Paddle — Orbirank never sees or stores raw payment card data), subscription and transaction records.
- Transfer mechanism
- Paddle is headquartered in the United Kingdom (Market Limited) and operates as a Merchant of Record under applicable data protection frameworks.
- Location
- United Kingdom; United States of America.
- Privacy information
- Paddle Privacy Policy
- Role
- Cloud infrastructure and hosting provider. All Orbirank platform data is stored and processed on Hetzner servers.
- Data processed
- All personal data stored or processed by the Orbirank platform (account data, SEO project data, credentials vault, logs).
- Transfer mechanism
- Data is stored within the European Union (Germany). No cross-border transfer safeguards required for EU/EEA personal data.
- Location
- Germany (European Union).
- Privacy information
- Hetzner Privacy Policy
- Role
- Content delivery network (CDN), DDoS protection, DNS management, and network security for the Orbirank platform and website.
- Data processed
- IP addresses and request metadata (page URLs, request headers, timestamps) transiting Cloudflare's network on the way to Orbirank's servers.
- Transfer mechanism
- EU Standard Contractual Clauses. Cloudflare participates in the EU–US Data Privacy Framework.
- Location
- United States of America (global network; EU traffic primarily processed in European PoPs).
- Privacy information
- Cloudflare Privacy Policy
- Role
- Bing Webmaster Tools API integration, enabling Orbirank to retrieve Bing search performance data for websites where you have granted OAuth access.
- Data processed
- OAuth access tokens; Bing Webmaster Tools performance data (queries, clicks, impressions, crawl statistics) for your registered websites.
- Transfer mechanism
- EU Standard Contractual Clauses. Microsoft participates in the EU–US Data Privacy Framework.
- Location
- United States of America (and other Microsoft Azure regions).
- Privacy information
- Microsoft Privacy Statement
Changes to This List
We review this list regularly and update it when sub-processors are added, changed, or removed. Material changes (addition of a new sub-processor that processes personal data in a new category) will be communicated to customers with at least 14 days' notice via email or in-app notice, in accordance with Section 12.3 of the Terms of Service and Section 13.1 of the Privacy Policy.
To object to the addition of a new sub-processor, or for any questions about this list, contact [email protected].