Effective date: 10 October 2026
BroadNet Technologies LLC, the operator of iBlockSpam, uses the subprocessors below. Each one acts under a written agreement that limits its use of personal data to the services it provides to us and includes data protection obligations at least as protective as our Data Processing Agreement ("DPA"). This list forms Annex 3 of the DPA.
1. Current subprocessors
| Subprocessor | What it does for us | Personal data involved | Location |
|---|---|---|---|
| Email filtering subprocessor (US-based; identity available as described in section 2) | Operates our filtering infrastructure: receives, scans, quarantines, spools and delivers inbound email; runs the outbound relay; sends quarantine digests; keeps message history; provides the quarantine and settings panel. It also filters and relays email to and from our own @iblockspam.com addresses, including account email we send you | Customer email content and metadata, quarantine and message history records, user email addresses and settings; the content of email exchanged with us | United States |
| Stripe, Inc. and its affiliates | Payment processing, checkout, invoices, tax ID collection and the customer billing portal | Billing contact details, company name and address, tax ID, payment card data (entered directly with Stripe), transaction records | United States, and other locations where Stripe operates |
| Cloudflare, Inc. | Content delivery, DNS, protection against attacks and bots, and the encrypted tunnel between the internet and our server | Website and portal traffic, including IP addresses and request details, and content passing through it in transit | Global network |
| The Constant Company, LLC (Vultr) | Hosts the server that runs our website, customer portal, administration systems, database, encrypted backups and @iblockspam.com mailboxes | Account, inquiry, domain and DNS, and billing records (not full card numbers); support email; server logs | France (EU) |
| Anthropic, PBC | AI model provider for our support email assistant, which categorises messages sent to our @iblockspam.com addresses, drafts replies, and may send automatic replies to routine questions (see our Privacy Policy) | The content of the support conversation being handled, including names and email addresses in it | United States |
Which subprocessors handle customer email? Email sent to your protected domains is processed only by the email filtering subprocessor. The other subprocessors handle website, account, billing and support data. If you send us message samples or headers in a support request, they're handled as support email.
Stripe acts as an independent controller for some of its own processing, such as fraud prevention and meeting financial regulations, under Stripe's privacy policy.
2. Our email filtering subprocessor
We don't publish the name of our email filtering subprocessor on our website, for commercial reasons. That doesn't limit your rights:
- Identity on request. Where data protection law gives you the right to know the identity of our subprocessors, as the European Data Protection Board confirmed in Opinion 22/2024, we'll give you its legal name, address and contact person on request, so you can assess it before you rely on it. We ask you to keep that information confidential, and the request never delays your rights.
- Same protections. It is bound by a written agreement with data protection obligations no less protective than our DPA, including confidentiality, security measures, breach notification, and deletion of data at the end of the service.
- Its own subprocessors. It may use its own providers, such as data centre operators and other service providers, under written terms. We'll share details on request.
- Location. It processes email in the United States. Transfers from the EEA, UK and Switzerland are covered by the safeguards in section 3.
To ask, email privacy@iblockspam.com from an account owner's address or on behalf of a customer that is evaluating the Service.
3. International transfers
Where a subprocessor processes personal data from the European Economic Area, the United Kingdom or Switzerland in a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum and the Swiss amendments where they apply, or on another valid mechanism such as the EU-US Data Privacy Framework where the subprocessor is certified. Vultr hosts our systems in France, within the EU. We are established in the United Arab Emirates; the same safeguards cover access to personal data by our own staff from there.
4. Changes to this list
We give at least 30 days' notice before adding or replacing a subprocessor that processes customer personal data, by email to account owners and by updating this page. If you aren't an account owner but want notice of changes (for example, your data protection officer), email privacy@iblockspam.com and we'll add you to the notification list.
You can object to a new subprocessor on reasonable data protection grounds within that notice period, as described in section 6 of the DPA. In an emergency, such as a subprocessor's sudden failure, we may need to make a change with shorter notice; we'll then tell you as soon as we can, and the same objection right applies.
5. Questions
Questions about our subprocessors, or requests for the filtering subprocessor's identity: privacy@iblockspam.com.
Last updated:
This document will be reviewed by our legal counsel; we'll notify customers of any material change.