1. Purpose
This Subprocessor List identifies external providers and provider categories that HuoPuo may use to process personal data in connection with its website, business communications, payments, optional WhatsApp communications, support, security, and related services. It supports the HuoPuo Privacy Notice and DPA.
A provider is listed only to the extent it processes personal data for HuoPuo in relation to the relevant service. Provider roles may vary by service, geography, product configuration, Customer instructions, and the provider’s own terms.
2. Scope and Important Limits
▪Customer-selected hosting providers, Customer-selected AI services, Customer-selected third-party integrations, Customer-controlled backup providers, and other providers independently enabled or controlled by Customer are not HuoPuo subprocessors merely because Customer uses them with the Software.
▪HuoPuo does not host Customer production environments. Customer determines and controls where the HuoPuo system is deployed.
▪HuoPuo internal CRM, support-ticketing, monitoring, logging, backup, and related internally operated systems are not separate third-party subprocessors.
▪This list does not require HuoPuo to disclose source code, security-sensitive materials, contractor identities, contributor identities, internal legal analysis, confidential internal records, or the non-public identity of its public-website hosting provider.
3. Confirmed Service Providers and Processing Categories
| Provider / Service | Purpose | Personal data categories | Service scope | Status / notes |
|---|---|---|---|---|
| Public website hosting / infrastructure provider | Hosting and operation of HuoPuo public website and related public online materials. | Website visitor technical data, IP address, request data, security events, website logs, and related online operational data depending on configuration. | HuoPuo public website only; not Customer production hosting. | Third-party provider used; provider details are not currently disclosed publicly. |
| Stripe | Payment processing, payment administration, saved payment method support, recurring/subscription payments where enabled, refunds, payment disputes, fraud-prevention, tax/accounting support, and related payment operations. | Billing contact data, transaction data, payment status, invoice references, payment token or payment-method identifier, Stripe Customer ID where required, PaymentIntent/transaction reference, last four digits of card, card brand/type, amount, currency, and related reconciliation data. Full PAN, CVV/CVC, PIN, full track data, and expiry month/year are not stored by HuoPuo under the current application payment record. | Customer-facing payment processing where Stripe is used through Stripe Elements / Stripe Payment Element. | Current payment provider. No other payment provider currently identified. |
| Meta / WhatsApp | Optional general business communications where WhatsApp is used by HuoPuo or a contact. | Business contact details, phone number, message content, metadata, and files voluntarily sent through WhatsApp, subject to Meta/WhatsApp terms. | General communications only. Not a required support channel, legal notice channel, privacy request channel, or security reporting channel. | Optional/non-essential channel. Customers should not send credentials, payment-card data, regulated data, confidential Customer Data, or sensitive diagnostic materials through WhatsApp unless a secure process is expressly designated. |
| Cloudflare | Network security and performance for the HuoPuo public website, including bot management, abuse protection, and security challenges. | Website visitor technical data, IP address, request data, and security event data. | HuoPuo public website only. Not Customer production hosting and not analytics or advertising. | In use. Sets security cookies described in the HuoPuo Cookie Policy. |
| Website analytics through Google Analytics 4, and advertising measurement, conversion tracking, and remarketing through Google advertising products. | Website visitor identifiers, device and browser data, IP address, interaction and usage data, and advertising identifiers. | HuoPuo public website only. Not Customer Data and not Customer production environments. | In use, and placed only after visitor consent as described in the HuoPuo Cookie Policy. | |
| Apple and Google (app store and platform providers) | Distribution, delivery, and platform functions where an applicable HuoPuo Client Application is made available through their services. | Account, device, and purchase-related data processed by the platform provider under its own terms. | Applies only where an applicable Client Application is distributed through those services. Not applicable to HuoPuo Software deployed in Customer-controlled environments. | Applies only where such distribution occurs. |
4. Internal Systems and Non-Subprocessor Categories
| Function | Current treatment |
|---|---|
| CRM | Internal. No separate third-party CRM provider is identified. |
| Support ticketing | Internal. No separate third-party support-ticketing provider is identified. |
| Monitoring / logging | Internal. No separate third-party monitoring/logging provider is identified for HuoPuo-controlled personal data. |
| Backup provider | Internal for HuoPuo’s own internal systems. Customer-environment backups remain within Customer-controlled or Customer-selected infrastructure. |
| AI provider processing Personal Data | None as a standalone third-party AI provider at present. Customer-selected AI services are treated separately. |
| Email marketing provider | None currently. |
| SMS provider | None currently. |
| Google Workspace | Not used. |
| Analytics providers | In use. Google Analytics 4, as described in Section 3 and in the HuoPuo Cookie Policy. |
| Marketing / advertising providers | In use. Google advertising products, as described in Section 3 and in the HuoPuo Cookie Policy. |
5. Customer-Controlled Providers
Where Customer deploys the Software in a Customer-controlled, on-premises, private-cloud, offline, public-cloud, colocation, sovereign-cloud, or mixed environment, Customer may select its own hosting providers, infrastructure providers, backup providers, AI services, integrations, and communications systems. Such providers are not HuoPuo subprocessors merely because Customer uses them with the Software.
6. Change Notices and Objections
Where required by an applicable DPA, Order, or law, HuoPuo may provide notice of new or replacement subprocessors through legal materials, customer portal, email, Order, DPA, or another written method designated by HuoPuo. Customer may object to a new or replacement subprocessor on reasonable data-protection grounds within the period and process stated in the applicable DPA or written agreement.
7. Contact
▪General Contact: info@huopuo.com
▪Security Contact: security@huopuo.com
▪Legal/Privacy Contact: legal@huopuo.com