Legal documents
Preferium AS · 999 323 286
info@preferium.com
Privacy
Subprocessor Register
Who may process data for the platform, where and why.
For a concluded agreement, the document versions recorded in the accepted Order or signature apply. A new version on this website does not change the agreement by itself.
Jump to a section
Preferium AS · contact and company details
- Company
- Preferium AS
- Org. no.
- 999 323 286
- Registers
- Central Coordinating Register for Legal Entities (Enhetsregisteret, since 5 January 2013), Register of Business Enterprises (Foretaksregisteret) and VAT Register (Merverdiavgiftsregisteret)
- Office address
- Produksjonsveien 18, 2nd floor, 1618 Fredrikstad
- Postal address
- Sponheimveien 19, 1613 Fredrikstad
- Contact
- info@preferium.com · +47 977 91 286
1. About the register
This register lists the providers that may process personal data for the preferium.com website and its compliance platform, and for Preferium AI Edge, the product that agencies resell under their own brand. Preferium AS is responsible for supplier management. The actual processing and the agreement determine whether a recipient is a processor, a subprocessor or an independent controller. A provider is used only for functions that are actually enabled; a planned or assessed provider is not thereby active.
The subprocessors covered by a specific Data Processing Agreement are identified through the register version tied to that agreement. This page is not by itself the Customer's written authorization, a delivered notice or evidence that a transfer instrument has been concluded.
2. Providers for preferium.com and the compliance platform
These providers are present in the website's source and configuration. Their public terms were checked on 8 September 2026.
| Provider and legal entity | Service scope, data and role | Processing locations and documentation status |
|---|---|---|
| Cloudflare, Inc. | Website hosting (Workers), DNS, security, rate limiting, Turnstile form protection, Access login for the owner-only administration, and the D1 database that stores consent receipts, privacy and incident cases and audit evidence; request metadata and the content each function processes | Public Customer DPA version 6.4 (3 April 2026) and subscription terms exist, relying on the EU standard contractual clauses and the Data Privacy Framework for restricted transfers. The D1 database is created with EU jurisdiction; the edge network processes requests globally. Status on 19 September 2026: the account is on a paid Workers plan; a record of the account-specific agreement and transfer basis has not yet been filed |
| Resend (Plus Five Five, Inc.) | Transactional email: contact-form and waitlist notifications, privacy request verification links and separately approved case notices; recipient, message content and delivery metadata when an email is sent. Sender addresses are on preferium.com; the mailbox is info@preferium.com | Public DPA of 27 August 2026 states primary processing in the United States and provides for the EU standard contractual clauses (Module 2) and the Data Privacy Framework. Status on 19 September 2026: a record of the account agreement and the applicable module has not yet been filed; EU-only email processing is not documented |
| Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) | Google Analytics 4 on preferium.com, page views only, after analytics consent; page and referrer address, network IP address, browser and device, consent signals and the _ga and _ga_* identifiers. No custom events, user ID, Google signals, advertising features or cross-domain measurement. Ad measurement and ad personalization are not configured | Google's data processing terms for Google Analytics; onward transfer to Google LLC (United States) under the EU Standard Contractual Clauses and the Data Privacy Framework as documented by Google. Data retention in the property is set to 2 months without reset on new activity. Status on 19 September 2026: Google's processor terms and transfer documentation were archived as provider evidence on 9 September 2026; a record of the property's acceptance of those terms has not yet been filed |
Cloudflare's DPA may be incorporated in the applicable account agreement, and Resend's DPA may be concluded by incorporation or signature. The absence of a separately signed PDF is therefore not by itself evidence that an agreement is missing. A public standard agreement does not prove which agreement or transfer mechanism applies to our specific processing either. See Cloudflare's DPA, Cloudflare's subscription terms and Resend's DPA.
3. Providers for Preferium AI Edge
Client workspace data is stored in the EU (Stockholm). Edge delivery runs on Cloudflare's global network, and AI measurement providers are listed in the subprocessor register. The list below follows the product's records of processing (last reviewed 14 August 2026) and its source code as read on 19 September 2026. It is scoped to the functions a Customer actually enables; the register version tied to a Customer's agreement governs that Customer.
| Provider | Purpose and data | Main locations and transfer basis |
|---|---|---|
| Cloudflare, Inc. | Global edge delivery of connected websites, DNS and certificates, security, Workers compute and storage, browser rendering for checks after deploy, and technical logs. Cloudflare Workers AI, through AI Gateway, generates optimization content (titles, meta descriptions, headings, structured data, alternative text and translations) and suggestions for tracked prompts | Global including the United States; EU SCC, UK IDTA and the Data Privacy Framework where applicable |
| Supabase, Inc. | Database, authentication and workspace storage | EU, region eu-north-1 (Stockholm); support and vendor access may transfer under SCC |
| Google LLC and relevant entities | OAuth, Search Console, Analytics, PageSpeed, Knowledge Graph and Gemini measurement, as enabled by the Customer | United States and global; DPF and SCC |
| OpenAI (account contracting entity pending verification) | ChatGPT citation and visibility measurement; tracked prompts are sent and may contain personal data depending on their content | United States and other documented locations; account-specific entity and transfer basis remain unverified |
| Anthropic, PBC | Claude citation and visibility measurement; tracked prompts are sent. Not used to generate client content | United States; SCC |
| Perplexity AI, Inc. | Perplexity citation and visibility measurement; tracked prompts are sent | United States; SCC |
| Stripe Payments Europe, Ltd. and affiliates | Payments, subscriptions and fraud prevention for the Customer's own Stripe account connected to the platform | EU (Dublin) and global under Stripe's terms |
| Resend (Plus Five Five, Inc.) | Transactional email from the product | United States with EU presence; SCC and DPF |
| DataForSEO OU (published provider identity) | Keyword, SERP, backlink and competitor data, and Google AI Mode measurement | Estonia; the public policy also lists vendors in Germany, the United States and the United Kingdom. Account-specific processing and transfer arrangements remain unverified |
| Sentry, Inc. | Data-minimised error and performance monitoring | EU/US; DPF and/or SCC |
Provider identity check, 20 September 2026: OpenAI's published DPA names OpenAI Ireland Ltd for EEA and Swiss customers and OpenAI OpCo, LLC otherwise. The accepted agreement for our account has not been verified. DataForSEO's privacy policy identifies DataForSEO OU, registry code 14502291, in Estonia and lists vendors in several countries; it does not establish EU-only processing for our account.
Generating content and measuring visibility or citation are different processing activities and may use different providers. The transfer mechanism depends on the actual entity, certification, contract and transfer assessment. Listing "SCC" or "DPF" does not replace execution of the required instrument. Unresolved agreement and transfer matters must be settled before the affected processing starts; a reservation on this page does not replace a necessary agreement or a lawful transfer basis.
4. Changes and objections
The Customer's general written authorization is given through the concluded Data Processing Agreement and the register version tied to it. Before an ordinary new or replacement subprocessor is used, the agreement's 30-day notice and 14-day objection period apply. The periods are agreed terms, not universal GDPR deadlines. We document the notification and handle reasoned objections before activation.
A website update is not by itself evidence that the Customer has been notified. An emergency change must be justified, approved and followed by notice without undue delay. Actual recipients and known delivery status are documented; a provider's acceptance of an email is not the same as confirmed delivery.
We make reasonable efforts to offer an alternative. If none exists, the Customer may terminate the affected Service before the change takes effect and receive a proportionate refund of unused prepaid fees. A provider may be changed without prior notice where necessary for security, continuity or legal requirements; we then notify without undue delay.
Notices and questions: info@preferium.com. Earlier register versions are available on request.
5. Infrastructure jurisdictions and government access
Client workspace data is stored in the EU (Stockholm), but global edge delivery, AI calls, measurement, email, payment, support and monitoring may involve processing outside the EEA. We therefore do not claim that all Customer Data remains in the EU/EEA.
Within applicable law and agreements, Preferium and its providers challenge disproportionate government demands, disclose only what is lawfully required, document requests and notify the affected Customer where permitted. Necessary supplementary measures such as encryption, access limitation and data minimisation are assessed and documented for the specific transfer.
An adequacy decision is used only where the recipient and the transfer are covered. For the United States, any reliance on the EU-US Data Privacy Framework must rest on the actual recipient's relevant participation. A recipient in the United Kingdom is assessed under the applicable decision and its scope; this does not mean that every onward transfer from the United Kingdom is covered. Where another instrument is necessary, the specific binding instrument and the assessment for the transfer are stated.