Subprocessors named from the code reviewed
This list matches the inventory in infrastructure/compliance/public-legal.mjs. It is not a HAR from a live browser session. A vendor is omitted when the code does not name it.
| Party | Purpose | Region | Transfer mechanism |
|---|---|---|---|
| Cloudflare | Edge hosting for Workers (asap-today, launch.oniyore.com, and other workers in this repo). oniyore-fe-landing next.config.ts allows cloudflareinsights.com in CSP. | Not pinned in repo config | Not stated in code |
| Google Analytics 4 | Analytics measurement G-7EJ0ZCTWKW on oniyore.com, loaded by option-fe-core only after stored analytics consent. | Not pinned in repo config | Not stated in code |
| Google Tag Manager | Not configured for oniyore.com (gtm id empty in file config). Present only in other site file configs listed on the privacy-choices page. | Not pinned in repo config | Not stated in code |
| Google Workspace | Mailbox host for @oniyore.com (MX comment in the landing mailbox module). | Not pinned in repo config | Not stated in code |
| Telegram | Contact and lead-routing links (t.me). No processor contract is in the files reviewed. | Not pinned in repo config | Not stated in code |
| Oniyore API (api.oniyore.com) | First-party API for leads, review submission, and checkout calls from the landing app. | Not pinned in the landing platformApi module | Not stated in code |
| PostgreSQL (application database) | Application data store used by option-backend. Public pages do not name a cloud vendor or region. | Not published in the files reviewed | Not stated in code |
| SMTP mail transport | option-backend sends commercial and transactional mail. The transport file does not name the SMTP vendor. | Unknown — vendor not named in email_transport.go | Not stated in code |
Payments: the landing terms page mentions card, PayPal, and bank wire. The checkout widget reviewed calls the Oniyore API to accept terms. No PayPal or Stripe SDK was found in oniyore-fe-landing source. Those names are not confirmed subprocessors.
Hotjar: option-fe-core can load Hotjar after consent if a site id is set. No Hotjar site id was found in the oniyore.com file config reviewed, so Hotjar is not listed as active there.
International transfers
Regions above are “not pinned” where the repository does not state a country. This draft does not claim standard contractual clauses, a UK transfer addendum, or an adequacy decision. A processor agreement stub is at /legal/dpa (docs/compliance/dpa-template-stub.md). Signed client agreements are not in this repository.
Sale and share
Oniyore does not sell or share personal information as those terms are defined under the CCPA/CPRA. Non-essential tags stay off when a visitor opts out or sends Global Privacy Control.
No Global Privacy Control signal on this response.