Core providers
| Provider | Purpose | Data | Processing location |
|---|---|---|---|
| Cloudflare, Inc. | Workers compute, D1, R2, KV, security, observability, Email Service, and optional AI services | Account, workspace, service telemetry, customer-directed product data, transactional email | Cloudflare global network and configured data-location controls |
| Stripe and Sold through Link | Merchant-of-record checkout, subscription billing, indirect tax, fraud, disputes, transaction support, and receipts | Billing contact, order, payment, subscription, tax location, fraud and support data | Stripe-controlled locations and safeguards described in its services agreement and privacy notice |
| Plotmesh | Customer-enabled creative production, quality, rights, provenance, and receipts | Brand rules, creative briefs, source assets, generation metadata | According to the customer’s Plotmesh agreement and selected model routes |
Customer-directed connected platforms
Advertising, commerce, payment, subscription, app-store, analytics, and MMP platforms are connected only at the customer’s direction. Depending on the relationship, they can be independent controllers, customer processors, or Yieldline subprocessors. Examples include Meta, TikTok, Google Ads, X Ads, Microsoft Advertising, LinkedIn Ads, Reddit Ads, Apple Ads, Whop, Stripe, RevenueCat, Shopify, Paddle, GA4, Amplitude, and Mixpanel.
Enabling an integration authorizes the documented data flow shown before connection. Read and write scopes remain separate. Advertising providers bill the customer directly; their payment methods are not collected or stored by Yieldline.
Better Auth
Better Auth is software included in Yieldline’s Worker deployment. It is not a hosted subprocessor in this architecture. Authentication records are stored in the customer-facing Yieldline Cloudflare data plane.
Changes and objections
We will update this list before adding a new core provider that materially changes processing. Contract customers with notice rights can object on reasonable data-protection grounds within the period stated in their data processing agreement.