DRAFT — pre-launch working copy, not yet reviewed by counsel
Subprocessors
Last updated: July 25, 2026 (draft)
A subprocessor is an outside company that handles data on our behalf so that Mostrel can work at all — the servers your page is served from, the database it is stored in, the pipe your contact-form email travels down. Below is every one of them, what it does, and exactly what reaches it.
Each is bound by its own data-processing terms and may only use what it receives to provide its service to us. None of them are permitted to use your data for their own purposes, and none of it is sold.
Current subprocessors
Cloudflare
Cloudflare, Inc. — United StatesRuns essentially all of Mostrel: application hosting, the cache that serves public pages, file storage for your images, delivery of contact-form email, the human-check on contact forms, and aggregate visitor counts.
Everything the product handles passes through Cloudflare — your account details, your published pages and images, contact-form messages, and the short-lived counters used for rate limiting. Requests from people viewing your page terminate here too.
PlanetScale
PlanetScale, Inc. — United StatesHosts the Postgres database behind the dashboard.
Account records, your profile and block content, image metadata, and contact-form submissions. Public profile pages are served from cache and never query the database, so viewing a page reaches nothing here.
GitHub
GitHub, Inc. (Microsoft) — United StatesOptional sign-in provider, and the source for importing your repositories into a starting profile.
Only if you sign in with GitHub or use the import: your GitHub account identity and the public repository details we read to build blocks. We request the read:user scope and nothing more. The six-hourly refresh of imported repository snapshots uses our own credentials, not yours. Nothing about people viewing your page is ever sent to GitHub.
OpenAI
OpenAI, L.P. — United StatesAutomated screening of uploaded images against the acceptable-use line, so that obvious violations are caught before a page is published.
The image itself, sent once when you upload it, with no account identifier attached. Its answer is only a flag for human review — it never deletes anything. No text, no messages, and no visitor data are sent. API inputs are not used to train OpenAI’s models.
What we deliberately do not use
No advertising networks, no third-party analytics or session-recording products, no marketing or CRM platforms. Visitor analytics are counted by Cloudflare on our own infrastructure and are aggregate by construction — no cookies, no fingerprinting, no per-visitor records — so there is no visitor profile anywhere to hand to anyone. The only third-party code that runs on a public profile page is the Cloudflare human-check, and only on pages that have a contact form.
Our typefaces are served from our own servers rather than a font CDN. It is a small thing, but a font loaded from someone else’s domain hands them the IP address of every person who looks at your page, and we would rather not introduce a company into that list for the sake of three fonts.
Coming later
Two additions are expected before general launch, and this page will be updated in advance of either going live: an AI provider for the optional import suggestions (which would only ever receive public repository text — never visitor data, never contact-form messages), and a payment processor once paid plans exist.
Changes to this list
We update this page whenever a subprocessor is added, replaced, or dropped. For material changes we also email account holders before the change takes effect, so there is time to object or close an account.
Contact
Questions about this list, or a request for the underlying processing terms: privacy@mostrel.com (draft note: inbound routing for this address still needs to be configured). For how we handle data generally, see the privacy policy.