Recent policy changes
Every change we detect across tracked vendors lands here first. Newest first — each links to the vendor's page and its official source.
Cal.com's subprocessor list has expanded significantly with 12 new data processors added, including Postmark for transactional email, Trigger.dev for background jobs, Upstash for caching, Google Places for address autocomplete, Mapbox for geocoding, AvatarAPI for profile photos, Browser Use for phishing checks, People Data Labs for lead enrichment, and others. Additionally, existing processors have been reorganized with more complete contact information and refined data processing descriptions.
The effective date of the Google Cloud Privacy Notice changed from September 28, 2026 to July 10, 2024. Additionally, the current content appears to be a Portuguese translation of the privacy notice, and references to "Service Data Addendum" were replaced with references to "Google Workspace for Education Service Data Addendum" in certain sections.
The effective date of the Google Cloud Privacy Notice has changed from September 28, 2026 to July 10, 2024. This represents a significant change to when the privacy policy becomes effective. The document provided appears to be a Japanese translation of the privacy notice with the updated effective date.
The effective date of the Google Cloud Privacy Notice has changed from September 28, 2026 to July 10, 2024. The current content appears to be a Dutch language version of the privacy notice. This represents a significant change to the effective date of the privacy policy.
The effective date of the Google Cloud Privacy Notice changed from September 28, 2026 to July 10, 2024. Additionally, the reference to "Service Data Addendum" has been changed to "Google Workspace for Education Service Data Addendum" with a corresponding update to the Supplemental Privacy Notice link.
The previous content showed only a browser traffic check message. The current content now displays the complete Railway Data Processing Addendum (DPA), establishing comprehensive requirements for data processing including obligations for Customer compliance with Privacy Laws, Company restrictions on use of Personal Data, audit rights, and subprocessor notification procedures with a 10-day objection period.
AWS hosting regions expanded to include Australia, Japan, and Singapore in addition to existing Germany, Ireland, and USA. Okta identity regions expanded to include Australia in addition to existing Ireland and USA. Gitar Products added to the list of SonarSource products utilizing these subprocessors. A note was added that "September 30 Update: New AWS hosting regions and Okta identity regions are now available, giving you more choice in where your data is processed." Additionally, Clerk's data location was clarified to specify USA instead of Global.
The effective date of the Google Cloud Privacy Notice has changed from September 28, 2026 to July 10, 2024. Additionally, the notice now references a "Supplemental Google Cloud Privacy Notice" specific to Google Workspace for Education (replacing the previous "Service Data Addendum" language), which changes how processing purposes apply to organizations that have accepted this addendum.
The DPA was restructured and significantly expanded. Section 1 changed from "Structure" (entity selection based on account location) to "Scope" (broader statement of applicability). Section 2 added new Affiliate roles including "independent Data Controller" status. Personal Data categories expanded to include "cryptocurrency wallet address." Section 3.3 changed from CCPA-specific obligations to broader "United States Specific Data Protection Obligations" covering all US State DP Laws with six detailed requirements replacing the previous three-part CCPA certification.
Stripe updated its list of service providers, sub-processors, and affiliates with multiple material changes: removed Stripe, Inc. (replaced by Stripe, LLC as of January 3, 2026), removed Stripe Payments Europe Limited - Italian Branch (replaced by new Stripe Italy S.r.l.), removed Mitek Systems, Inc., and removed Lemon Squeezy, LLC from sub-processors list (now called Sold Through Link, LLC in affiliates). Added multiple new sub-processors and service providers including Microsoft Corporation (Azure cloud services), Snowflake, Inc., LoanPro Software LLC, January Technologies, Inc., InscribeAI, Inc., and new cloud providers for Stripe Data Pipeline. Updated Terminal fulfillment partners and added new affiliate Metronome Technologies, Inc.
The effective date of the Google Cloud Privacy Notice has changed from September 17, 2026 to July 10, 2024. Additionally, the document has been translated to Portuguese (Brazil), and there are references to a "Supplemental Google Cloud Privacy Notice" specifically for Google Workspace for Education Service Data Addendum, replacing a previous generic reference.