Subprocessors & Third-Party Services
Effective date: 16 September 2026 Last updated: 16 September 2026
This page describes service providers and third-party services that may process data in connection with the operation of Kepio.
The exact legal role of a provider can vary by service and data flow. In some cases a provider acts as a processor/subprocessor and in others as an independent controller under its own terms.
Privacy contact: info@kepio.eu
1. Core hosting infrastructure
Provider: The production hosting/infrastructure provider used by Kepio. The current provider name is available on request at info@kepio.eu.
Purpose:
- web hosting,
- PHP runtime,
- database hosting,
- server logs,
- backups and infrastructure operations, depending on the hosting setup.
Primary processing region: The current processing region depends on the active production hosting setup and is available on request at info@kepio.eu.
2. Transactional email provider
Provider: The transactional SMTP/email provider configured for the production Kepio environment. The current provider name is available on request at info@kepio.eu.
Purpose:
- email verification,
- password reset,
- operational notifications,
- requested checklist/acknowledgement,
- billing/service communications where applicable.
Primary processing region: The current processing region depends on the active email provider and is available on request at info@kepio.eu.
The exact email route depends on the SMTP/email provider configured in the production Kepio environment.
3. Stripe
Provider: Stripe and the relevant affiliates/entities applicable to the transaction.
Use in Kepio:
- subscription checkout,
- billing portal,
- payment/subscription status,
- payment transaction and reconciliation metadata,
- invoicing/billing operations where enabled.
Data:
- billing/contact information required for the payment flow,
- payment-provider IDs,
- subscription/payment status,
- transaction metadata.
Full card information in a hosted Stripe flow is provided directly to Stripe and does not need to be stored by Kepio.
Stripe publishes its service-provider/subprocessor list:
https://stripe.com/service-providers/legal
Stripe’s legal role may vary by function and jurisdiction under Stripe’s terms and privacy framework.
4. Google — Google Analytics
Provider: Google.
Use:
- measurement of public pages only after analytics consent.
Current implementation:
- basic consent: the GA4 tag does not load before consent,
- ad_storage denied,
- ad_user_data denied,
- ad_personalization denied,
- Google Signals disabled by the application.
We do not send financial calculator values, lead email or store URL in GA4 events.
Google Privacy Policy:
https://policies.google.com/privacy
5. Google — Search Console
Provider: Google.
Use:
- read-only Search Console reporting in the Admin SEO console,
- clicks, impressions, CTR, position and related search-performance data when connected.
Kepio uses a read-only Search Console OAuth scope.
This connection belongs to Kepio’s global admin SEO setup and is separate from merchant Google Ads integrations.
6. Google Ads integration
Provider: Google.
Use:
- optional merchant-authorised Google Ads connection,
- reading selected advertising-account information for spend and marketing context.
The connection is authorised by a company user and is not required to use Kepio.
The merchant remains responsible for permissions and the terms of its Google account.
7. Meta Ads integration
Provider: Meta Platforms and the relevant entities for the account.
Use:
- optional merchant-authorised Meta Ads connection,
- reading advertising-account data for spend and marketing attribution context.
The current connection uses read-oriented permissions required for account discovery and advertising reporting. Page-publishing permission is not required for the core profitability use case.
Meta Privacy Policy:
https://www.facebook.com/privacy/policy/
8. Merchant-selected third-party services
When you choose to connect a store, advertising or other provider, that service may process data under its own contract and privacy policy.
The existence of an integration with Kepio does not mean that every integration provider is automatically a Kepio subprocessor for every purpose.
9. Professional advisers and authorities
In limited circumstances, necessary data may be disclosed to:
- accountants,
- legal advisers,
- auditors,
- insurers,
- competent authorities or courts,
where necessary for a professional service, legal obligation or defence of claims.
10. International transfers
Providers may use infrastructure or affiliates in more than one country.
Where applicable law requires it, transfers should rely on an appropriate mechanism such as:
- an adequacy decision,
- Standard Contractual Clauses,
- another lawful transfer mechanism provided by the relevant provider.
For providers such as Stripe or Google, the exact transfer mechanisms are described in their own legal/privacy documents.
11. Changes to this list
This list is updated when the production infrastructure changes materially or when a provider is added that receives data to operate Kepio.
12. Contact
For questions about providers, processing or transfers: info@kepio.eu