Xonvert uses a deliberately small set of third-party providers to operate. Each receives only the minimum data needed for its function and is bound by data-processing terms (DPA + Standard Contractual Clauses where applicable). Your file contents are never shared with any of these providers — files are processed in your browser.
Current list
| Provider | Purpose | Data received | Region |
|---|---|---|---|
| Stripe, Inc. | Card payments + invoicing | Email, name, billing address, last-four of card, IP, payment amount | US (with EU SCCs) |
| NOWPayments | Cryptocurrency payments | Email, payment amount, crypto receipt id, IP | EU |
| Resend | Transactional email (sign-up, verification, billing) | Email address, message contents | EU + US (with EU SCCs) |
| Brevo (Sendinblue) | Backup transactional email and notifications | Email address, message contents | EU |
| Cloudflare, Inc. | DNS, DDoS protection, CDN | IP, request metadata, brief security cookie | Global edge (with EU SCCs) |
| Hugging Face | CDN for on-device AI model weights | IP of the downloading browser, requested model id | EU + US |
| jsDelivr | CDN for static library assets | IP of the downloading browser, requested asset path | Global edge |
What is NOT on this list
We do not use Google Analytics, Facebook Pixel, advertising networks, retargeting platforms, session replay vendors, or any data broker. We do not pipe your data to anyone for marketing.
Changes to this list
Before we add a new subprocessor with access to personal data, we update this page. If you have an active Pro subscription and want to be notified by email when this list changes, write to support to opt in.
Questions
For questions about a specific provider or to request the relevant DPA documentation, contact support.