Sub-processors
Last updated: 9 April 2026
Cadu uses the following third-party sub-processors to deliver its service. This list applies to processing carried out on behalf of Customers under the Data Processing Agreement.
Where a sub-processor is located outside the European Economic Area or the United Kingdom, Cadu relies on the European Commission's Standard Contractual Clauses (Decision 2021/914), and where applicable the UK International Data Transfer Addendum, as the legal mechanism for international transfers.
Current sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloudflare | Hosting, edge compute, storage (KV, D1, Durable Objects), and content delivery for both cadu.app and Customer websites. | Global, with EU data residency available. SCCs in place. |
| Anthropic | AI processing of inbound messages (the Claude API is used to interpret instructions and generate website content). Message content sent to Cadu is processed by Anthropic's models. | United States. SCCs in place. |
| Dodo Payments | Payment processing and merchant of record for Cadu subscriptions and credit purchases. Receives Customer billing information (name, email, billing address, card details via its own PCI-compliant processors) but no website visitor data. Hosts the self-service billing portal used by Customers to manage subscriptions and invoices. | Global, with EU data residency available. SCCs in place. |
| Meta Platforms Ireland Ltd. (WhatsApp Business) | Messaging channel between Cadu and Customers. Inbound and outbound WhatsApp messages, including any media attachments, are routed through the WhatsApp Business Platform. | Ireland (EU) and United States. SCCs in place. |
| GitHub (Microsoft) | Source code storage for Customer website files. Each Customer site is stored in a private repository owned by Cadu. | United States, with EU data residency available for some products. SCCs in place via Microsoft's Data Protection Addendum. |
Notification of changes
Cadu will notify Customers of any intended additions to or replacements of sub-processors at least 30 days in advance, by updating this page and (where reasonably practicable) by notification through the Cadu service. Customers may object to a new sub-processor on reasonable data protection grounds within that period, as set out in Section 6 of the DPA.
Contact
To object to a sub-processor or to ask questions about this list, please email privacy@cadu.app.