Legal
Subprocessors
These are every third party that receives data from this website. The list is generated from
docs/legal/subprocessors.yaml in our repository, and our build fails if a new
third-party dependency appears without a matching entry — so this page cannot quietly
go stale.
This page covers prjctlazrus.com only. The product landing pages linked from our product pages are separate deployments, and the products themselves — Kairos, Heirloom, eXitZork, W33KND, NeoPlus — have their own processors that are not listed here.
Active on every page view
Vercel Inc. — hosting
| Role | Processor |
|---|---|
| Purpose | Hosts the website, delivers it globally, and runs the serverless function behind the contact form |
| Data received | IP address; browser and device type; page requested and referrer; contact form contents in transit; pseudonymised submission logs |
| Region | United States. Pages are served from Vercel's global edge network; the contact function runs in iad1 (Washington, D.C.) |
| Transfer safeguard | EU Standard Contractual Clauses (2021/914, Modules 1–3) and the UK International Data Transfer Addendum, incorporated automatically into the Vercel agreement |
| Terms | vercel.com/legal/dpa |
Removed on 5 September 2026
Google (Google Fonts) and Cloudflare, Inc. (cdnjs) were both active on every page view until 5 September 2026. Neither was our processor, and neither was covered by a contract we were party to. Typefaces are now subset and served from prjctlazrus.com, the icon webfont was removed rather than replaced, and the Content Security Policy no longer lists either origin.
Active only in specific circumstances
Resend — email delivery (contact form only)
| Role | Processor |
|---|---|
| Legal entity | Plus Five Five, Inc. |
| Purpose | Delivers your contact form message to us as an email |
| Data received | Name, email address, subject, message body |
| Region | United States |
| Transfer safeguard | Standard Contractual Clauses attached to Resend's Data Processing Addendum |
| Terms | resend.com/legal/dpa |
Google — Google Analytics 4 (only with your consent)
| Role | Processor |
|---|---|
| Purpose | Website analytics — which pages are read, property G-62WCEKB4P3 |
| Data received | Cookie identifier (_ga, _ga_62WCEKB4P3); IP address; page URL, title and referrer; device, browser, OS, language, screen size; event names. No name, email, subject or message content. |
| Region | United States and other Google locations |
| Transfer safeguard | Google Ads Data Processing Terms, applying the 2021 Standard Contractual Clauses to restricted European transfers |
| Terms | business.safety.google/adsprocessorterms |
| When | Never loads unless you accept analytics. Refusing, or sending a Global Privacy Control signal, means the script is never fetched |
Present in code but not active
Meta Platforms, Inc. — Meta Pixel
The Meta Pixel loader exists in our analytics code but has never been configured with a real pixel ID, so nothing is requested from Meta and no Meta cookie is set. We list it here because it is in the code and you can read the code.
If we ever enable it, it will sit behind the same consent gate, and we will update the privacy policy and add a “Do Not Sell or Share My Personal Information” link before switching it on — enabling an advertising pixel changes our obligations under US state privacy law, and doing it quietly is exactly the failure we built the gate to avoid.
What we deliberately do not use
Recorded so that the absence is a decision rather than an oversight:
- No object storage or file hosting provider — the site stores no files
- No database — nothing is persisted server-side
- No authentication provider — there is no signup and no login
- No payment processor — there is nothing to buy
- No AI or model provider — no user content reaches a language model
- No session replay, heatmap, attribution or advertising SDK
- No support chat or customer messaging widget
Changes to this list
We review this list quarterly and update it whenever a provider changes. To be told about changes before they take effect, email hello@prjctlazrus.com and ask to be added to the subprocessor notification list.