Subprocessors
Every company that can touch your data, what it does, and where it is. Five entries - by design.
Last updated 14 August 2026 · plain English, and short on purpose.
The list
| Who | What they do | What they see | Where |
|---|---|---|---|
| Scalingo | Hosting and the application database | Everything the product stores: accounts, projects, generated audio, usage counters | France (osc-fr1, Paris) |
| Dodo Payments | Merchant of record: checkout, tax, invoices, card storage | Billing name, email, address for tax, card details (never seen by us) | United States, with EU processing for EU customers |
| Resend | Transactional email (invitations, password reset, welcome) | Recipient address and the contents of that message | United States (Amazon SES, us-east-1) |
| Cloudflare | DNS for naadly.com and forwarding of mail sent to the domain | Domain queries; the contents of email you send us | Global edge |
| Cloudflare R2 | Object storage for generated audio, when the deployment sets it up | Generated and uploaded audio files | Configurable region |
Notably absent
No analytics vendor, no advertising network, no session recorder, no CDN for fonts, no support-chat widget, no email marketing tool, no AI provider. Speech is synthesised on containers we run, not handed to an API - which is also why the price does not move when someone else's does.
Changes
Account owners are emailed before a new subprocessor starts handling data, and the data processing addendum gives you the right to object.