Sub-processors

When you build a site with Husly and collect data about your visitors on it, you are the controller of that data and WebAdmin OÜ (“Husly”, “we”) is the processor. To provide the Service, we use the companies below. They process personal data for us and on our instructions. Each one has a contract with us that gives it the same data protection obligations that our Data Processing Agreement requires.

Your sites and their database run on our own server in Estonia (EU). No other company runs that server.

The list

Cloudflare

• Purpose: Network and security in front of the sites (CDN and proxy), storage of uploaded files (R2) and the bot check on forms (Turnstile).
• Data: The IP address and request data of visitors; the files that you and your visitors upload.
• Location: USA (company); servers worldwide, also in the EU
• Transfer basis: EU-US Data Privacy Framework; Standard Contractual Clauses

Resend

• Purpose: Sending the Service's emails: form notices to you, automatic replies to your visitors, sign-in and account emails.
• Data: Email addresses, names and the content of the email (for example the form answers).
• Location: USA
• Transfer basis: EU-US Data Privacy Framework

Anthropic

• Purpose: The AI text features: the editor's assistant, site and text generation, translation, image alt texts, and the AI chatbot on your site.
• Data: What you write to the AI and the site content it needs; the messages that visitors write to your chatbot.
• Location: USA
• Transfer basis: Standard Contractual Clauses

Google (Gemini API)

• Purpose: Voice typing in the editor (speech to text) and one of the image engines.
• Data: The voice recording of a user who types by voice; the image prompt.
• Location: USA
• Transfer basis: EU-US Data Privacy Framework; Standard Contractual Clauses

OpenAI

• Purpose: Image generation, only when this engine is chosen.
• Data: The text of the image prompt.
• Location: USA
• Transfer basis: Standard Contractual Clauses

Leonardo.Ai

• Purpose: Image and video generation, only when this engine is chosen.
• Data: The text of the prompt.
• Location: Australia
• Transfer basis: Standard Contractual Clauses

ElevenLabs

• Purpose: Read-aloud voices for blog posts, when you pick an ElevenLabs voice.
• Data: The text of the blog post.
• Location: USA
• Transfer basis: EU-US Data Privacy Framework; Standard Contractual Clauses

Tartu Ülikool (TartuNLP)

• Purpose: Estonian read-aloud voices for blog posts, when you pick a Tartu voice.
• Data: The text of the blog post.
• Location: Estonia (EU)
• Transfer basis: No transfer (EU)

Only for your account

These providers see only the data of your Husly account, not the data of your site visitors. For them we are the controller, and our Privacy Policy applies.

• Stripe - payment and subscription processing.
• Google - “Sign in with Google” authentication (if you use it).
• PostHog - analytics of husly.app, with your consent.
• Browser push services - notifications in your browser, if you allow them; the content is encrypted.

Integrations that you connect yourself

Integrations that you connect yourself, with your own account, are not our sub-processors. Examples are Mailchimp, Smaily, Brevo, MailerLite, HubSpot, Pipedrive, Slack, Microsoft Teams, Discord, Telegram, Google Sheets, Google Search Console, Canva, your own analytics (PostHog, Google Analytics, Meta Pixel), your own Stripe account and webhooks. You choose them, they work on your account and their own terms, and the data goes to them on your instruction. Name them in your own privacy notice.

Content that loads from other services

Some blocks load content straight from another service into the visitor's browser: the Google Maps map block, YouTube or Vimeo videos, sample photos from Unsplash until you replace them, and Google Fonts for a font that is not in our own font copy. That service then gets the visitor's IP address directly. These services act on their own terms, not as our sub-processors. If you use such blocks, name them in your privacy notice and, where needed, in your cookie consent.

Changes and your right to object

Notice of changes. At least 30 days before we add a new sub-processor or replace one, we update the list of sub-processors with the planned date and send an email notice to everyone who has asked for notices. To get the notices, send an email to [email protected] with the subject “Sub-processor notices”, from the address that should get them.

Your right to object. You can object to a change within those 30 days, in writing to [email protected], if you have a reasonable reason related to data protection. We then look for a solution with you in good faith. If we cannot find one, you can end your subscription before the change takes effect, and we refund the fees you paid in advance for the time after the end.

If we must replace a sub-processor faster to keep the Service secure or running (for example, when the provider stops its service), we tell you as soon as we can. Your right to object stays the same.