Subprocessors & International Transfers

Pre-launch framework · Last updated 29 August 2026. Providers are listed as active only after production use is verified.

Current verified status

The reviewed Bilveo marketing site verifies only Paddle.js loaded from Paddle's CDN in sandbox/placeholder mode. A production host, database, authentication/email provider, AI provider, analytics provider and error-monitoring provider are not verified in that website repository.

Provider register

• Paddle: intended Merchant of Record / checkout / tax / payment processing. Sandbox script verified; live checkout and final Paddle entity are not yet verified.
• Production hosting/CDN: to be confirmed before public production use.
• Authentication / transactional email: to be confirmed.
• Database / backend storage: to be confirmed.
• AI provider(s): to be confirmed before AI features are activated.
• Analytics: not currently enabled in the reviewed website; future use requires inventory and consent analysis.
• Error/security monitoring: to be confirmed.
• Google Search Console / GA4: planned optional integration, not listed as active until implemented.
• Cloudflare AI Crawl / performance integrations: planned optional integration, not listed as active until implemented.

International-transfer rule

Before activating a provider that receives personal data outside Türkiye, Bilveo records the provider legal entity, processing location, controller/processor role, data categories, purpose, retention, security terms and the applicable KVKK Article 9 transfer mechanism. Where a standard contract is used, applicable signing and notification requirements must be completed.

EU data

If Bilveo intentionally offers services to persons in the EU in circumstances where GDPR Article 3(2) applies, the Article 27 representative requirement will be assessed and addressed before material regular targeting. This page will be updated as the production provider stack becomes final.