Current Subprocessors
Formation Ads uses the following third-party service providers (subprocessors) to operate the platform. Each processes data only to provide its service to us, under its own contractual data-protection commitments.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Vercel Inc. | Application hosting, serverless compute and content delivery | All application traffic and server logs | United States |
| Neon Inc. | PostgreSQL database hosting | All platform data at rest (accounts, campaigns, billing records, audit logs) | United States (AWS us-west-2) |
| Stripe, Inc. | Payment processing and invoicing support | Payment card data (entered on Stripe-hosted pages only; card numbers never touch Formation Ads systems), billing name and email, purchase history | United States |
| Cloudflare, Inc. | Bot protection (Turnstile) and object storage (R2) for uploaded creative assets, generated reports and the encrypted weekly database backup | Signup-form challenge telemetry; uploaded images and videos; generated PDF reports; the weekly database backup, encrypted (AES-256) before upload and held in a private bucket | United States / global edge network |
| Resend, Inc. | Transactional email delivery | Recipient email addresses and the contents of service emails (invoices, campaign status, security notices) | United States |
| Functional Software, Inc. (Sentry) | Error monitoring, performance tracing and session replay | Error reports and traces with sensitive fields redacted before transmission; session replay recordings of dashboard layout and interaction with all page text masked and media blocked | United States |
| Google LLC | Venue location search (Places API) | Venue and location search queries entered when adding tour stops (sent from our servers only) | United States |
| GitHub, Inc. (a Microsoft company) | Source control, continuous integration and the weekly offsite database backup job (GitHub-hosted runners) | During the weekly backup job a full database dump exists on a GitHub-hosted runner until it is encrypted and uploaded; the plaintext file is deleted before the job ends. Continuous integration runs against an in-process test database and never holds customer data | United States |
Independent Controllers
Meta Platforms, Inc. is not a subprocessor. When you connect a Facebook account and publish campaigns, Meta processes advertising data as an independent controller under its own privacy policy and advertising terms. Formation Ads transmits campaign configuration and creative content to Meta on your instruction and retrieves delivery metrics on your behalf; see our Privacy Policy for details.
Changes to This List
We update this page before engaging a new subprocessor that will process customer personal data. Organizations with an executed Data Processing Agreement are notified of material changes per the DPA (see our Terms of Service). Questions: legal@formationads.com.