Service providers · v0.3-beta
Service providers — 短.在线
Version: v0.3-beta
Last updated: 2026-11-02
Controller: Arasaka Oy (Business ID 2138210-8), Santaradantie 7 F 203, 01370 Vantaa, Finland
Language: English is controlling. A Simplified Chinese courtesy translation is available on the Chinese Service providers page (/zh-cn/legal/service-providers).
This page lists service providers, processors and other recipients that may process personal data in connection with the 短.在线 Service operated by Arasaka Oy. It supports our Privacy Policy.
Customer URL: /legal/service-providers (legacy /legal/subprocessors redirects here).
We update this list when we add or remove a provider. Material changes may also be noted in-product or by email where required.
How to read “GDPR role”
| GDPR role | Meaning (summary) |
|---|---|
| Processor | Processes personal data on our documented instructions (Art. 28 GDPR) |
| Independent controller / joint | Determines purposes/means itself (or jointly); not solely our processor |
| Controller tooling (self-hosted) | Software we operate ourselves on infrastructure already listed — not a separate third-party processor entity |
| Not yet engaged | Named for transparency; processing starts only when the feature is enabled in production |
| Service provider (no user personal data) | Provides a service to us but receives no personal data of our users; not our processor for user data |
A processor label is a working description of the activity. It is not a statement that an Article 28 contract has been signed.
These classifications are operational working labels. Finnish/EU counsel may refine them.
Currently engaged
| Provider | GDPR role | What they process / why | Typical region(s) | Notes |
|---|---|---|---|---|
| Vercel Inc. | Processor | Hosts the web application | EU (Frankfurt) for server functions; requests first reach Vercel's global edge network | Production web application hosting. Vercel Inc. is a US company. Transfers from the EEA/UK rely on the EU-U.S. Data Privacy Framework (including the UK Extension) and/or Standard Contractual Clauses (with the UK Addendum) |
| Cloudflare, Inc. | Processor | Publishes DNS for the brand domains. No Cloudflare China Network and no mainland ICP path | Not stated | No Cloudflare China Network / mainland China ICP path for the current Service |
| Fly.io, Inc. | Processor | Hosts the redirect service and the machine that runs our mail software | Not stated | Includes hosts used for brand mail software (see Stalwart row) |
| Stalwart (mail software self-hosted by Arasaka Oy on Fly.io) | Controller tooling (self-hosted) | Inbound abuse and privacy mail and security reports for abuse@短.在线, privacy@短.在线 and security@短.在线 | Brand domain / Fly region | Not a separate processor company. Not Google Workspace / Microsoft 365. Unicode display addresses; SMTP may use punycode |
| Postmark (AC PM LLC, an ActiveCampaign company) | Processor | Sending account and service emails, such as email address verification, password reset and notices of changes to our terms; processes the recipient email address, the message content (including the one-time link) and delivery metadata (for example timestamps, delivery or bounce status, and mail-server IP addresses) | US | Account and service emails only: no marketing, no open or link tracking. Transfers from the EEA/UK rely on the EU-U.S. Data Privacy Framework (including the UK Extension) and/or Standard Contractual Clauses. Inbound abuse@短.在线, privacy@短.在线 and security@短.在线 mail stays on Stalwart (above) |
| 101domain GRS Limited (Ireland) | Independent controller | Domain registration and DNS account administration; registration contact and DNS-change metadata | Ireland (EU) | Registrar services under its own privacy statement. Registry/ICANN public WHOIS or similar disclosures, where required, are also outside our control |
| Dropbox (Dropbox International Unlimited Company) | Processor | Stores off-site copies of our database backups, which contain account, link and click data | Not stated | Backup storage only. Not shared publicly |
| Zoner Oy | Processor | Hosts a server where we keep off-site copies of our backups, which contain account, link and click data | Not stated | Backup storage only |
| Space and Time Oy | Processor | Stores off-site copies of our backups, which contain account, link and click data. The copies are encrypted on our systems before upload, and Space and Time Oy does not hold the key | Not stated | Backup storage only |
| HetrixTools (HetrixTools, Inc.) | Service provider (no user personal data) | External uptime monitoring: checks that our public health-check URLs and one test short link respond, and sends outage alerts to our team by email (including our role address security@短.在线) and by Telegram message. Holds those public URLs, the check results (for example status code and response time) and our team's alert contact details | Not stated | Company in Oregon, United States. Receives no personal data of our users; its checks request only public URLs. Alerts go only to our team |
| Telegram (Telegram Messenger Inc.) | Service provider (no user personal data) | Receives outage alerts from HetrixTools (above) and delivers them to our team as a direct Telegram message. The alerts contain only the availability status of our public URLs | Not stated | Company located outside the EEA. Receives no personal data of our users |
Infrastructure components we operate ourselves on Fly.io (for example application processes and databases) are part of our hosting arrangement with Fly.io, not additional brand-name processors beyond Fly.io.
Engaged when the feature goes live
| Provider | GDPR role | What / why | Notes |
|---|---|---|---|
| Google LLC — Web Risk API (or licensed equivalent; not free Safe Browsing Lookup for commercial production) | Not yet engaged | Destination URL threat lookups at create / re-scan; URL and related request metadata | Activates when commercial URL-intel is enabled by Security (then: typically Processor). The Service may ship without a live lookup |
Other error or uptime monitoring vendors, or alert channels, will be added only when engaged.
Not used for the Service
- Mainland China hosting, China Network CDN, or ICP-based acceleration (deferred)
- Sale of identifiable clickstreams to advertisers or data brokers
- “防红” / censorship-evasion vendors as a product feature
Contact
Privacy requests: privacy@短.在线
Abuse reports: abuse@短.在线
Controller: Arasaka Oy · Law / venue: Finland
Privacy: privacy@短.在线 · Abuse: abuse@短.在线