Subprocessors
Last updated: October 20, 2026
1. Overview
Shadow Corp uses the service providers below to run this website, our forms, email, and internal systems. Each one processes personal data only on our instructions and under its data processing terms, which include confidentiality, security measures, and deletion at the end of the service. For transfers out of the EU, EEA, or UK they offer the European Commission’s Standard Contractual Clauses (and the UK addendum) in their terms. Data related to a client engagement (reports, evidence, credentials) is handled as agreed in that engagement’s contract and data processing agreement, and is not stored with these website providers unless the agreement says so.
2. Current subprocessors
Vercel
Vercel Inc.- Purpose
- Website hosting, serverless functions, and content delivery.
- Data
- Request data (IP address, user agent, URL, time) and everything submitted through our forms while it is processed.
- Location
- United States; global edge network
- Terms
- Data Processing Addendum (opens in a new tab)Privacy policy (opens in a new tab)Their subprocessors (opens in a new tab)
Supabase
Supabase Inc.- Purpose
- Database: contact requests, subscribers, Complaints Book records, cookieless statistics, abuse-prevention counters, and access logs.
- Data
- Identification and contact data you submit, hashed identifiers, and logs.
- Location
- United States (AWS us-east-1)
- Terms
- Data Processing Addendum (opens in a new tab)Privacy policy (opens in a new tab)Their subprocessors (opens in a new tab)
Resend
Resend (Plus Five Five, Inc.)- Purpose
- Transactional email: confirmations, newsletter, Complaints Book copies, and internal notifications.
- Data
- Recipient email address, message content, and delivery metadata.
- Location
- United States (AWS us-east-1)
- Terms
- Data Processing Addendum (opens in a new tab)Privacy policy (opens in a new tab)Their subprocessors (opens in a new tab)
Zoho Mail
Zoho Corporation- Purpose
- Business email inboxes (contact@, ir@, security@) where requests and notifications are received.
- Data
- Content of emails you send us and their metadata.
- Location
- United States (US data center)
- Terms
- GDPR and DPA information (opens in a new tab)Privacy policy (opens in a new tab)Their subprocessors (opens in a new tab)
Cloudflare
Cloudflare, Inc.- Purpose
- DNS, Turnstile anti-bot checks on our forms, and access protection for internal systems.
- Data
- IP address, user agent, and browser signals needed to tell people from bots.
- Location
- United States; global network
- Terms
- Customer DPA (opens in a new tab)Privacy policy (opens in a new tab)Their subprocessors (opens in a new tab)
3. Other recipients
- Telephony provider: routes calls and text messages to our incident line (a United States number). It processes caller numbers, call metadata, and message content.
- Professional advisers and authorities: lawyers and accountants bound by confidentiality, and authorities when the law or a valid court order requires it, including Peru’s consumer protection authority (INDECOPI) for Complaints Book records.
4. Changes and notice
We update this page before a new subprocessor starts processing personal data, and change the date at the top. Clients with a signed data processing agreement receive notice of new subprocessors as set out in that agreement (our template gives at least 30 days’ notice and a right to object). To ask about a provider, or to receive notice of changes, write to contact@sh4dowcorp.com.
Company registration in progress: our legal entity details (registered name and tax ID) will be published here once registration is complete. For any question about this document, contact us at contact@sh4dowcorp.com.