Subprocessors
Effective date: 8 August 2026
These are every company that can access personal data from Pogo, what each one does, and where it processes that data. Not all of them are subprocessors in the strict sense, so they are grouped by the role they play. It accompanies section 4 of the Privacy Policy, which explains the lawful basis for each. Locations are as each company publishes them; every name links to its own privacy documentation.
1. Processors
These companies handle personal data on our instructions, under a data processing agreement.
| Company | What it does | Personal data it can access | Where |
|---|---|---|---|
| Akamai Cloud (formerly Linode) | Servers, database, file storage, and backups | All account, organization, and content data | United Kingdom (London) |
| Stripe | Subscription payments, invoices, and payment fraud checks | Name, email address, billing address, and payment details | Ireland and the United States |
| Resend | Sending service email (verification, sign-in codes, billing notices) | Name, email address, and the contents of those emails | The United States |
| Google Workspace | Our own email, so anything you send to our support address | Your email address and whatever your message contains | Ireland and the United States |
| Cloudflare | Checking the sign-up bot check passed, which our server asks Cloudflare to confirm | IP address | Cloudflare's global network |
2. Services that load in your browser
These run as code in your browser, so they receive data from it directly, whether or not our servers also send them anything. Cloudflare is in both lists for that reason.
| Company | What it does | Personal data it can access | Where |
|---|---|---|---|
| Cloudflare | The Turnstile bot check on the sign-up form | IP address and browser signals | Cloudflare's global network |
| Giphy | The GIF picker on a retrospective board, and showing a chosen GIF to everyone who views that board | IP address, browser signals, and what you type in the picker | The United States |
| Google Ads | Measuring our advertising, on our public pages and only if you accept the consent banner. Nothing is loaded and nothing is sent unless you do | Only with your consent: IP address, browser signals, an advertising identifier, and which public pages you view | Ireland and the United States |
3. Sign-in providers
These apply only if you choose to sign in with them.
| Company | What it does | Personal data it can access | Where |
|---|---|---|---|
| Signing in with Google, if you choose it over a password | Name, email address, and avatar | Ireland and the United States |
4. What we do not use
We use no analytics vendor and no third-party session recording or error-reporting service. Our performance monitoring runs on our own servers. Our web fonts are served from this site. Google Ads is the one advertising service we use, it runs on our public pages only, and what it can do there depends on your answer to the consent banner - see the Cookie Policy. Apart from the services named above, nothing on our pages loads from a third party.
5. Changes
We update this page when a company is added or removed, and the date above changes with it. We will post an addition here before it starts handling personal data where we can; if you use Pogo as an organization and object to one, email support@podratic.com. Where a change affects how we handle personal data, we also tell you as described in section 10 of the Privacy Policy.