What's LiveSub-processors
Effective 22 September 2026
Han Yazılım Bilişim Hizmetleri uses a small number of third-party providers to run What's Live. This page names every one of them, what it is used for, what data it sees and where it is located.
Sub-processors
Each of these is used for one job, each is bound to process data only on our instructions, and each name links to its own privacy policy.
Most are processing data now. Where a provider appears here before it begins, that is deliberate rather than an error: giving notice in advance is what this page is for, and it is the safer direction to be wrong in.
| Provider | What it does | What it sees | Where |
|---|---|---|---|
| Vercel Inc. | Application hosting, serving and edge network. Every request reaches the service through Vercel. | IP address and request metadata in transit; server logs. Anything you submit passes through in transit. | United States (global edge network) |
| Supabase Inc. | Managed Postgres database, authentication, and object storage for avatars and listing thumbnails. | All account and listing data at rest: email, hashed password, username, avatar, listing content, counters. | United States |
| Cloudflare, Inc. | Turnstile bot detection on sign-up, sign-in and listing submission. | IP address and browser signals used to distinguish a person from an automated client. | United States (global network) |
| OpenAI, L.L.C. | Automated moderation of listing titles, descriptions, thumbnails, usernames and avatars before they are published. | The text or image being checked. No account identifiers are sent with it. Their handling of what they receive is governed by our service arrangement with them. | United States |
| Resend (Plus Five Five, Inc.) | Transactional email — account notices, closure confirmations, and the authentication emails for sign-up confirmation and password reset. | Your email address and the contents of the message sent to you. | United States |
| Functional Software, Inc. (Sentry) | Error and performance monitoring, so a fault that affects a creator can be diagnosed rather than guessed at. | Diagnostics of a failure: the error and its stack trace, the URL and route it happened on, and browser or server runtime details. Configured not to send IP addresses, and no account identifier is attached. No session recording. | United States |
| Mixpanel, Inc. | Product analytics — which pages, filters and listings get used, so the product is shaped by what people actually do. Not advertising, and not used to follow anyone to other sites. | Usage events against a random identifier held in your browser, and a creator's account id once signed in. Your IP address, from which it infers an approximate location — country, region and city, never more precise. Configured not to collect full page URLs or session recordings. Never an email address. | United States |
| Paddle.com Market Ltd | Payments for the optional Creator+ subscription. Paddle is the merchant of record, which means it is the seller for the transaction, it issues your invoice, and it handles payment and tax enquiries. It appears on your statement rather than us. | Your email address, billing country and postal code, and the payment details you enter into Paddle's own form — which reach Paddle directly and never pass through us. What comes back to us is the record of the subscription: the email, the name on the card and its last four digits. Never a card number. | United Kingdom and United States |
What we do not use
For the avoidance of doubt, and because their absence is a deliberate choice rather than an oversight:
- No advertising networks and no ad-tech pixels.
- No data brokers. We do not sell or share personal data for anyone else's marketing.
- No advertising or cross-site tracking. Product analytics runs on both the directory and the dashboard — see the Privacy Policy — but it is a processor measuring our own site, not an advertising network, and it does not follow anyone elsewhere.
- No social sign-in providers. Accounts use an email address and a password, so no social network is told that you have an account here.
International transfers
Several of the providers above are outside Türkiye and outside the European Economic Area, principally in the United States and the United Kingdom.
Under the GDPR and UK GDPR, a transfer outside the EEA or the UK rests on an adequacy decision covering that country where one applies, and otherwise on Standard Contractual Clauses — with the UK Addendum where the UK regime governs — or another safeguard recognised by law. Under the KVKK, transfers abroad rest on the bases in Article 9. Which one applies depends on the provider, so rather than let a list here go stale: write to us and we will tell you what a particular transfer rests on.
Our database is hosted in the United States. So for a creator in Europe, account and listing data is stored outside the EEA rather than inside it, and the safeguards above are what that transfer rests on. We would rather say so plainly than describe a European region we do not use.
How we announce changes
This page is the current list. When we add a sub-processor we update it here with a new effective date before that provider begins processing, and we tell creators with an account by email where the change materially affects how their data is handled.
To be told about additions in advance, or to ask about a specific provider, write to hello@whatslive.today.
Contact
Han Yazılım Bilişim Hizmetleri
Çınar Mh, Yeşiltepe Sk, No 3, Maltepe, İstanbul, Türkiye
hello@whatslive.today
See also the Privacy Policy and the Terms of Use.