Sub-processors
- Last updated
- May 30, 2026
- Version
- 2026.05
- Applies to
- EU · France · Canada · United States
In plain language
- Pyor has no server that sees your code. The app talks straight to GitHub from your machine, so your source, diffs, and token never reach a sub-processor.
- The vendors below process only the limited personal data that running a website and billing Teams requires — and only Stripe is named as a confirmed processor today.
- This reflects our current stack. We keep it accurate, and we give notice before adding a sub-processor that processes personal data.
1. What is a sub-processor
A sub-processor is a third party that «Registered legal entity name, e.g. Pyor Software SAS / Pyor Software, Inc.» (“Pyor”, “we”) engages to process personal data on our behalf, under contract, to help us deliver the Pyor website and Services. Because Pyor is a client-side product with no backend that receives your repositories, pull requests, diffs, or review notes, sub-processors never touch that material. They only ever handle the narrow set of personal data described in our Privacy Policy — what we need to run the site at pyor.review, operate accounts, and bill Teams.
We share data with a sub-processor only where it is necessary for one of those purposes, the vendor is bound by data-protection terms at least as protective as our own, and the transfer is covered by an appropriate safeguard. Card data is handled by Stripe; we never see your full card number.
2. Current sub-processors
The table below lists the sub-processors that may process personal data for Pyor today. Stripe is a confirmed, contracted processor. The remaining entries are representative of our current stack: the categories are accurate and necessary, and the specific vendors are shown as placeholders until each is finalised and verified here. This is a living document — see notice of changes below.
| Sub-processor | Purpose | Data processed | Location / Transfer mechanism |
|---|---|---|---|
| Stripe | Payments & billing | Billing contact and payment metadata (we store only a token and the last four digits). | United States / global — EU Standard Contractual Clauses (SCCs). |
| «Hosting/CDN provider» | Website hosting & content delivery | Site request logs (e.g. IP address, timestamps). | «Region» — SCCs. |
| «Transactional email provider» | Account & product emails | Email address. | SCCs. |
| «Cookieless analytics provider» | Aggregate site analytics — only with your consent | No personal profiles; aggregate, cookieless measurement only. | «Region». |
We do not engage sub-processors for advertising or cross-site tracking, and we set no ad cookies. Names shown as «…provider» are placeholders we will replace with the verified vendor — kept visible so an unfinished entry is obvious.
3. Notice of changes
We maintain this page as the authoritative list and keep it current. Before we add a new sub-processor that processes personal data, or materially change the role of an existing one, we will update this page and give reasonable advance notice.
- Teams customers can subscribe to changes by emailing privacy@pyor.review with the subject “Subscribe — sub-processor updates”. We’ll notify subscribers before a new sub-processor starts processing personal data.
- You may object to a new sub-processor on reasonable data-protection grounds. Write to privacy@pyor.review and we’ll work in good faith to address it; if we can’t, you may have remedies under your Data Processing Agreement.
4. International transfers
Some sub-processors process personal data outside your country, including in the United States. Where we transfer personal data out of the EEA, UK, Switzerland, or Canada, we rely on appropriate safeguards — chiefly the European Commission’s Standard Contractual Clauses (and the UK Addendum), together with a transfer-impact assessment and additional measures where needed. Business customers can sign our Data Processing Agreement, which incorporates the SCCs and lists the sub-processors authorised under it.
5. Contact
Questions about our sub-processors, or to subscribe to or object to changes: privacy@pyor.review. For the underlying processing, see our Privacy Policy.