1. What This Document Is
1.1 WebberUI (webberui.com) is operated by Teyra LLC ("we", "us", "our"). This page lists every third-party service provider that may process personal data on our behalf when you use webberui.com, plus a small number of third-party services we use that do not touch personal data of site users at all.
1.2 A "Subprocessor" is a third-party company that processes personal data on our behalf so that the service can run — for example, hosting our servers, storing our email list, or operating our sign-in system. Subprocessors act on our instructions; they are not free to use your data for their own purposes.
1.3 This list is deliberately short. We run WebberUI with as few data-touching vendors as we can, and the components you install from WebberUI never send data to us or to anyone on this list: installed components make no network calls to our servers, contain no telemetry or reporting mechanism, and are never remotely disabled. See the License Agreement at /license and the Privacy Policy at /privacy.
2. Our Commitments
2.1 We keep this list current. Before we add a Subprocessor, or materially change what an existing one does with personal data, we update this page and change the "Last updated" date above.
2.2 We tell you about changes that matter. Consistent with the Privacy Policy (/privacy): if a change affects how the early-access email list is used or who stores it, we notify list members by email. For other material changes, the updated date on this page (and on /privacy where relevant) is the notice mechanism.
2.3 We do not add trackers quietly. We will not silently introduce advertising pixels, data brokers, or cross-site tracking vendors. The one advertising provider on the Site is Google AdSense, listed below; adding any other would be a change to the Privacy Policy itself, with the notice obligations that entails.
3. Current Subprocessors and Third-Party Services
| Provider | Purpose | Personal data involved | Processing location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting and delivery of webberui.com (Cloudflare Workers); Cloudflare D1 storage for explicitly saved Composer/Theme Studio drafts, the early-access list, subscription/entitlement mappings, hashed license records, webhook deduplication, and limited download audit; storage of Pro component source files (Cloudflare R2 — contains no personal data); standard access and operational logs for debugging and abuse prevention; Cloudflare Web Analytics, a cookieless traffic and performance measurement beacon served on page loads; Cloudflare Turnstile, a bot-detection challenge on the early-access form (currently closed) | Workspace drafts: Clerk user ID, selected component identifiers or theme settings, revision and update timestamp. Email-list record: email address, source page, consent version and time, created/updated timestamps, status. Billing and entitlement records: billing email received from Paddle, Paddle customer/subscription/transaction IDs, Clerk user ID, plan or price, status, period start/end dates, currency, total and invoice number, checkout-intent records, webhook event IDs, one-way license-key hash and limited successful-download scope/time. Turnstile: challenge and browser signals and the visitor IP address are handled by Cloudflare when the form widget runs; we store none of it. No raw license key, card number, IP address, or browser user agent is stored in these D1 application tables. Access/operational logs and Web Analytics are described in the Privacy Policy | Global edge network for content delivery. D1 database: no jurisdiction restriction is configured, so Cloudflare assigns the primary location; we do not represent a specific data-residency guarantee |
| Clerk, Inc. | Sign-in, account and organization management, and subscription entitlements. Entirely optional — see Section 5 | Email address and sign-in identifiers (including an account identifier from any third-party sign-in provider offered on the sign-in page, such as Google or GitHub, if you choose one), name, user and organization IDs, session cookies and tokens, and plan/entitlement flags | the United States |
| Transactional email provider — not yet selected | Transactional and notification email: the early-access launch notice, policy-change notices, any legally required renewal notices, and breach notification. Clerk's built-in email covers only authentication flows (sign-in verification and similar), not these notices | Recipient email address and message metadata | Not applicable yet. We will name the provider and its processing location on this page before the first notification email is sent |
| Google (Google Analytics 4) | Consented website audience and traffic measurement | Pseudonymous browser identifiers, page and referrer paths, browser/device information, and events from enabled GA4 enhanced-measurement settings (such as searches and form interactions); no account IDs or emails sent by our code. Google signals and advertising personalization disabled in the tag | Google global infrastructure; see https://policies.google.com/technologies/partner-sites |
| PostHog, Inc. | Product analytics — which pages and components are used, so we know what to build next | A random, pseudonymous identifier stored in a cookie and localStorage; page views, referrer, a fixed code-defined list of product events (for example "component viewed", "install command copied"), and performance metrics (Web Vitals). Never linked to your account: we never call PostHog's identify function, so PostHog does not learn who you are. Like any web request, analytics requests carry your IP address to PostHog's servers. As configured on 2026-08-13, "Discard client IP data" is not enabled for our project, so the IP is stored with the event | United States (PostHog US Cloud) |
| Paddle.com Market Limited | Merchant of record and subscription billing for WebberUI Pro (3-day pass, monthly and annual plans). Paddle.js is loaded on the checkout page. Paddle collects payment details and acts as an independent controller for its own merchant-of-record processing (payment, tax, fraud prevention) | Collected by Paddle at checkout: name, billing email, address and tax details, payment method data, and fraud-prevention signals. Sent to Paddle by us: our internal Clerk user ID in transaction metadata. Sent to us by Paddle: billing email, Paddle customer/subscription/transaction IDs, plan, status, period dates, currency, total and invoice number. We never see or store full card numbers | United Kingdom and United States |
| Google LLC / Google Ireland Limited (AdSense) | Advertising shown to visitors who are not Pro subscribers. Google acts as an independent controller for its own ad-serving processing; we are not its processor and send it no personal data of our own. Not loaded for Pro subscribers | Collected by Google directly from your browser when an ad is requested: IP address, browser and device data, page address, advertising cookies or identifiers. We receive none of it | United States and other countries where Google operates |
| npm, Inc. / GitHub, Inc. | Public distribution of the @webberui/mcp npm package |
None. The package is a public download; distributing it involves no personal data of webberui.com users | Not applicable (no site-user personal data processed) |
4. Notes on the Table
4.1 Cloudflare is our infrastructure: the entire site runs on Cloudflare Workers behind Cloudflare DNS. D1 stores the limited email-list, billing, entitlement, hashed-license-key, webhook-deduplication, and successful-download audit fields listed in the table above and in the Privacy Policy. We deliberately store no IP address or browser user agent in those application tables. Cloudflare also produces standard access logs (Workers Logs); our application emits limited operational/security error events but does not intentionally log raw keys, payment credentials, webhook bodies, or email-list form contents.
4.2 Clerk processes personal data only if you choose to create an account or sign in; the free tier never requires it (Section 5). What our application reads from Clerk is narrow: your user and organization IDs, your subscription entitlements, an administratively set "pro" flag where applicable, and your first name (shown in the account menu). Clerk sets its own session cookies when you sign in. Signing in alone does not grant paid workspace access.
4.3 PostHog is configured with tracking features off wherever possible: session recording disabled, autocapture disabled, surveys disabled, dead-click capture disabled. Events are a fixed, code-defined list and carry only things like component names, page types, and document slugs — never your email address or account identity. If the PostHog key is not configured in a deployment, PostHog does not run. In the EU/EEA, United Kingdom, and Switzerland, the Site also prevents the PostHog module, requests, and identifiers from loading until the visitor affirmatively allows usage analytics. Analytics can be rejected, withdrawn from the footer, or blocked with a content blocker without breaking any site functionality. See the Cookie Policy at /cookies.
4.4 Payments. Paid plans are sold through Paddle as merchant of record. Paddle receives your payment details directly; we receive the billing email and transaction details listed in the table above and keep them as described in Privacy Policy Section 3.8. Billing terms, including automatic renewal and refunds, are governed by the Refund & Billing Policy at /refunds and the Terms of Service at /terms.
4.5 npm / GitHub are distribution channels for a publicly downloadable package, not processors of site-user data. The package ships with our license terms; see /license.
5. Zero-Account Use
5.1 The free tier requires no account. You can browse the site and install free-tier components without logging in or giving an email address. In that mode, the only processing that may touch you is usage analytics when enabled or allowed (Section 4.3), plus Cloudflare's standard access logs (Section 4.1).
5.2 Saved favorites, theme settings, and similar preferences normally live in your browser. When an eligible signed-in user explicitly saves a Composer or Theme Studio cloud draft, the draft and account identifier are stored in Cloudflare D1 as described in Privacy Policy Section 3.6.5. See the Cookie Policy at /cookies.
6. How You Learn of Changes
6.1 This page (/subprocessors) is the canonical list. The "Last updated" date changes whenever the list changes — we do not bury Subprocessor changes in a changelog.
6.2 Members of the early-access email list receive email notice of any change that affects how their email address is used or who stores it, consistent with the Privacy Policy (/privacy).
7. Related Documents
- Privacy Policy — /privacy
- Terms of Service — /terms
- License Agreement — /license
- Cookie Policy — /cookies
- Refund & Billing Policy — /refunds
8. Contact
Questions about this list or any provider on it: official@teyrallc.com. WebberUI is a service of Teyra LLC.