Last updated: 11 October 2026
KissMySkills (Dzmitry Pliachko KREAL, Wrocław, Poland) uses the providers below to run kissmyskills.com and the KissMySkills apps: AI CRM, the connector for AI assistants (MCP), Receptionist, Contracts, the Tools hub and free tools, and file delivery.
"Customer Data" means the personal data our business customers put into the apps (contacts, deals, comments, candidates, website-chat visitors, contract counterparties). For Customer Data we are a processor under our Data Processing Addendum.
Feature-only? "No" means the provider is used for every customer of that product. "Yes" means it processes data only when you use that specific feature.
Get notified of changes
We announce a new or replaced subprocessor, or a change in where one processes Customer Data, on this page and by e-mail at least 30 days before it takes effect. To receive these e-mails, write to hello@kissmyskills.com with the subject "Subprocessor updates". You can object as described in section 6 of the DPA.
Hosting / Infrastructure
| Name | Purpose | Data categories | Location | Transfer mechanism | Product | Feature-only? |
|---|---|---|---|---|---|---|
| Cloudflare, Inc. (USA) | Application hosting (Workers), databases (D1), key-value storage (KV), file storage (R2), DNS, TLS, DDoS and bot protection (Turnstile, WAF), access control for admin tools (Access), application logs, point-in-time recovery | All Customer Data stored in the apps; account e-mail; uploaded files (CVs, contracts, delivery files); IP address, user agent, request logs | Cloudflare's global network; stored data is kept in Cloudflare data centres, which may be outside the EEA (no regional restriction is set today) | Cloudflare DPA with SCCs; EU-US Data Privacy Framework (DPF) | All | No |
AI
| Name | Purpose | Data categories | Location | Transfer mechanism | Product | Feature-only? |
|---|---|---|---|---|---|---|
| Cloudflare, Inc., Workers AI | Running open AI models on Cloudflare's infrastructure to draft Receptionist replies and to power the free and paid tools. Not used to train models; no third-party model provider receives the data | Receptionist: site name, up to 3 of the site owner's configured answers, and the visitor's question (max 500 characters, with e-mail addresses and phone numbers removed before sending); switchable off per site. Tools: text you submit to an AI tool | Cloudflare's global network; inference may run outside the EEA | Cloudflare DPA with SCCs; DPF | Receptionist; Tools hub and free tools | Yes |
The CRM, Contracts and the connector make no AI model calls of their own.
| Name | Purpose | Data categories | Location | Transfer mechanism | Product | Feature-only? |
|---|---|---|---|---|---|---|
| Resend (Plus Five Five, Inc., USA) | Transactional e-mail: sign-in codes and links, onboarding e-mails, CRM daily digest, contract renewal reminders, download links | Recipient e-mail; e-mail content (digests and reminders may contain deal or contract titles from your workspace) | USA | Resend DPA with SCCs | All (sign-in); CRM (digest, if on); Contracts (reminders, if set) | No (sign-in); Yes (digest, reminders) |
Analytics
| Name | Purpose | Data categories | Location | Transfer mechanism | Product | Feature-only? |
|---|---|---|---|---|---|---|
| PostHog Inc., PostHog EU Cloud | Product analytics, error tracking and session replay in the CRM and on sign-in pages, and on the store after analytics consent | Pseudonymous user ID, pages and actions, device and browser data, approximate location from IP. Replays mask form inputs (in the CRM, all text as well) | EU (Frankfurt, Germany) | Within the EEA; PostHog DPA | CRM, sign-in pages; store (after consent) | No (apps); Yes (store, consent) |
| Google Ireland Ltd. (with Google LLC, USA) | Google Analytics 4 on the store, after consent | Cookie IDs, pages viewed, device data | EU / USA | Google data processing terms; SCCs; DPF | Store only | Yes (consent) |
We also read aggregated reports from our own Google Analytics 4 property through a Google service account for internal reporting on the Tools hub. This sends no Customer Data to Google, and customers do not connect their own Google accounts to the Tools hub.
Anonymous storefront analytics (product views and searches, daily-rotating code, 90-day retention) run on our own Cloudflare infrastructure and need no extra subprocessor.
Payments / Commerce
| Name | Purpose | Data categories | Location | Transfer mechanism | Product | Feature-only? |
|---|---|---|---|---|---|---|
| Shopify International Ltd. (Ireland), with Shopify Inc. (Canada) | Online store, checkout, payments, orders and subscriptions (Shopify Subscriptions), store e-mails (Shopify Email / Messaging), store search and other Shopify-built store apps; our apps read orders to know your plan | Name, e-mail, billing address, order data, e-mail engagement. Card data stays with Shopify Payments | Ireland / Canada / USA | Adequacy (Canada); SCCs and DPF under Shopify's DPA | Store; plan checks in all apps | No |
Shopify-side providers do not receive Customer Data from the apps.
Shopify apps
Apps installed on the store:
- Apps built by Shopify (Subscriptions, Shopify Email / Messaging, Search & Discovery, Knowledge Base, Shopify Claude Connector, SimGym, Shopify Counter) are part of Shopify's service and are covered by the Shopify entry above.
- Apps built by us (KMS Connector, KMS bulk edits, KREAL MCP KMS, FAQ Metafield Updater, KMS Tools Hub) are run by KissMySkills itself on the infrastructure listed above. They are not separate subprocessors.
- Third-party apps that receive no personal data: T Lab by Sherpas Design (translation of store content) and InstaIndex by klipp.tech (SEO and structured data). They process store content such as product texts only, so they are not subprocessors.
Support
| Name | Purpose | Data categories | Location | Transfer mechanism | Product | Feature-only? |
|---|---|---|---|---|---|---|
| Zoho Corporation B.V. (Netherlands), Zoho Mail EU | Support mailbox hello@kissmyskills.com | Whatever you send us: name, e-mail, message, attachments | EU (zoho.eu) | Within the EEA | All | Yes (only if you write to us) |
Not subprocessors
- Your AI assistant. When you connect Claude (Anthropic), ChatGPT (OpenAI) or another AI client through the connector, your client reads and writes your workspace on your instruction, under your own agreement with its provider. You choose and authorise it; it is not our subprocessor. We do not send Customer Data to Anthropic, OpenAI or other model providers ourselves.
- Bring your own key (Receptionist). Switched off. If it is ever enabled and you turn it on, messages go to the provider of the key you supply, under your agreement with that provider.
- Telegram. We use Telegram only for internal operational alerts to the owner. These alerts contain no names or e-mail addresses, only pseudonymised identifiers, workspace IDs, event types and country, so Telegram does not process Customer Data or Account Data in identifiable form.
- Public CDNs for browser libraries. Some in-browser tools load open-source libraries from cdn.jsdelivr.net or cdnjs.cloudflare.com; your browser fetches them directly (exposing your IP to the CDN). Files are processed locally in your browser.
Changes
| Date | Change |
|---|---|
| 2026-10-11 | First published list. Cloudflare (hosting; Workers AI for Receptionist and tools), Resend, PostHog EU, Google (store analytics), Shopify (including Shopify-built apps), Zoho Mail EU. Telegram, T Lab and InstaIndex classified as not subprocessors (no personal data in identifiable form). |