Subprocessors

Last updated 1 October 2026

Hexcraft AB uses the processors below to run xiaoquiz. This page is referenced by our Data Processing Agreement and our Privacy Policy.

We announce changes to this list — a new, replaced, or removed subprocessor — at least 30 days before they take effect, so customers under a DPA have time to object. To be notified, email privacy@xiaoquiz.com.

Cloudflare, Inc.

• Purpose: Hosting & compute (Workers), database (D1), realtime game state (Durable Objects), media storage (R2), transactional email (Email Routing), and bot protection on signup (Turnstile).
• Data location: European Union — D1, Durable Objects and R2 are pinned to Cloudflare’s EU jurisdiction.
• Transfer safeguard: US-parent company; EU Standard Contractual Clauses + EU–US Data Privacy Framework.

Stripe Payments Europe, Ltd. / Stripe, Inc.

• Purpose: Payment processing for event passes and the annual subscription — engaged only if an organization buys a paid plan.
• Data location: EU (Stripe Payments Europe, Ltd.), with processing by Stripe, Inc. (US).
• Transfer safeguard: Standard Contractual Clauses + EU–US Data Privacy Framework.