This page lists the companies that process Customer Content or Account Data for us, what each one does, and where. It forms part of Schedule 3 of our Data Processing Addendum (https://koalafix.com/dpa), which sets out how we choose Subprocessors, the contracts we have with them, and how you can object to a new one. Words such as Customer Content, Account Data and Space have the meanings in "Words we use" in our Terms of Service. The "In short" lines are summaries only; the full text is what counts.
1 · What a Subprocessor is
In short: a Subprocessor is a company we use to run KoalaFix that handles your data for us.
A Subprocessor is a company we use that processes Customer Content or Account Data for us, such as our hosting provider or the service that sends our emails. It acts only on our instructions, to help us provide KoalaFix to you.
Your people's AI clients, and the model providers behind them, aren't our Subprocessors (section 5).
2 · How we choose and manage them
In short: we check each provider, sign data protection terms with it, and stay responsible for it.
Before we use a Subprocessor, we check its security and privacy commitments and put in place a written contract that requires it to protect the data at least as well as our DPA does, as far as relevant to its service. We check again when its terms, or the way we use it, change. We remain responsible to you for what our Subprocessors do with your data (see "Subprocessors" in the DPA).
3 · Subprocessors that handle Customer Content
In short: Microsoft hosts KoalaFix and runs our AI models, and Cloudflare runs our DNS (and, once we turn on its proxy, carries traffic to KoalaFix).
| Company | What it does for KoalaFix | Data it handles | Can it see Customer Content? | Where it processes data | Transfer safeguard |
|---|---|---|---|---|---|
| Microsoft Corporation (Microsoft Azure) | Hosts the KoalaFix service and its database, including backups | Customer Content and Account Data stored by KoalaFix (sign-in data is with Supabase) | Yes: it's stored on Microsoft's infrastructure | Australia East (New South Wales, Australia). The geo-redundant backup copy is also in Australia | Stored in Australia. Microsoft's Data Protection Addendum, which includes the EU Standard Contractual Clauses and the UK Addendum |
| Microsoft Corporation (Azure OpenAI: embeddings) | Turns memory and search questions into embeddings, so agents can search by meaning | The text of memory and search questions | Yes, to create each embedding. Microsoft doesn't use it to train models. Microsoft's abuse monitoring may store flagged text in Australia for review by authorised Microsoft staff | Australia East | As above |
| Microsoft Corporation (Azure OpenAI: AI judge) | Compares new memory with similar memory and suggests clean-ups, when the judge is on | The text of new memory and the similar memory it's compared with | Yes, to make each suggestion. Microsoft doesn't use it to train models. Microsoft's abuse monitoring may store flagged text in Australia for review by authorised Microsoft staff | Global deployment: any region where Microsoft runs the model | As above |
| Cloudflare, Inc. | Runs DNS for koalafix.com and mcp.koalafix.com. Once we turn on its proxy, it also carries and protects traffic to KoalaFix | IP addresses and, once the proxy is on, traffic to and from KoalaFix | Once the proxy is on, in transit only; it doesn't store Customer Content | Cloudflare's global network | The EU–US Data Privacy Framework, with the EU Standard Contractual Clauses and UK Addendum as a fallback |
Registered addresses
- Microsoft Corporation: One Microsoft Way, Redmond, WA 98052, United States
- Cloudflare, Inc.: 101 Townsend Street, San Francisco, CA 94107, United States
4 · Subprocessors for accounts, email, billing and support
In short: Supabase runs sign-in, Brevo sends our emails, Stripe takes payments, and Microsoft 365 hosts our support mailbox. None of them sees your team memory, except anything you choose to send us for support.
| Company | What it does for KoalaFix | Data it handles | Can it see Customer Content? | Where it processes data | Transfer safeguard |
|---|---|---|---|---|---|
| Supabase Pte Ltd (Singapore) | Sign-in: accounts, password hashes, Google sign-in identities and sessions | Names, email addresses and sign-in records | No | Sydney, Australia | Stored in Australia. Supabase's Data Processing Addendum, which includes the EU Standard Contractual Clauses, the UK Addendum and Swiss terms |
| Sendinblue SAS, trading as Brevo (France) | Sends account emails: sign-up confirmations, password resets, invitations, Trial reminders and receipts | Names, email addresses and the content of those emails | Only names and email addresses in invitations | France (EU). Brevo's own providers may process some information in other countries, including the US and India | Processed in the EU. Brevo's Data Processing Agreement covers its own transfers |
| Stripe Payments Australia Pty Ltd | Takes payments and issues invoices, once billing is switched on. Stripe also acts as an independent controller for fraud prevention and legal compliance | Billing contact details, card details (held by Stripe only), billing address, tax ID and payment history | No | The US and other countries where Stripe operates | The EU–US Data Privacy Framework, with the EU Standard Contractual Clauses and UK Addendum |
| Microsoft Corporation (Microsoft 365) | Hosts our email, including the support@koalafix.com mailbox | Support emails, and anything you send us with them | Only what you choose to send us for support | Australia | Stored in Australia. Microsoft's Data Protection Addendum |
Registered addresses
- Supabase Pte Ltd: 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513
- Sendinblue SAS (Brevo): 9-17 rue Salneuve, 75017 Paris, France
- Stripe Payments Australia Pty Ltd: 1 Sussex Street, Barangaroo NSW 2000, Australia
- Microsoft Corporation: as in section 3
5 · Not our Subprocessors
In short: the AI tools your people use, Google sign-in and GitHub aren't our Subprocessors.
- Your people's AI clients and model providers, such as Claude Code, Codex, Cursor and Gemini CLI. When KoalaFix gives your people's agents team memory or check-in descriptions, that content goes to whichever AI provider your people use, under your arrangement with that provider.
- Google, when your people choose Sign in with Google. Google is the sign-in provider you choose.
- GitHub, which distributes the KoalaFix plugin. It doesn't process Customer Content for us.
- Your own database provider, if you're on the Enterprise plan and bring your own Postgres database. You choose and contract with that provider.
6 · Our website
In short: koalafix.com is served through Cloudflare and uses cookies, analytics and advertising pixels from Google, Meta, LinkedIn and X. We also send them hashed email addresses and conversion events for advertising. They never receive Customer Content.
Our website, koalafix.com, is served through Cloudflare. It uses cookies, analytics and advertising pixels from Google (Google Analytics and Google Ads), Meta (the Meta Pixel), LinkedIn (the LinkedIn Insight Tag) and X (the X Pixel). We also send these providers hashed email addresses and sign-up, Trial and payment events for advertising, as "Who we share it with" in our Privacy Policy explains. They receive website visitors' data and that advertising information, never Customer Content. They act under their own terms and aren't Subprocessors for Customer Content. We don't use advertising pixels in the KoalaFix dashboard or the Service, and we never use Customer Content for advertising. "Cookies and similar technologies" and "Who we share it with" in our Privacy Policy explain them and how to opt out.
7 · Changes and how to object
In short: we give 30 days' notice before adding or changing a Subprocessor. You can subscribe to notices, and object.
7.1 Notice
At least 30 days before a new Subprocessor starts processing Customer Content or Account Data, or an existing one starts doing something materially different with it or processing it in a new country, we'll update this page and email your Admins and anyone subscribed to notices. The notice says who the Subprocessor is, what it will do, what data it will handle and where. If we have to replace a Subprocessor urgently, for reasons outside our reasonable control, we'll tell you as soon as we can.
7.2 Subscribing
Anyone can subscribe to notices of changes to this page by emailing support@koalafix.com with "Subscribe" in the subject line.
7.3 Objecting
If you object to a change, email support@koalafix.com within 30 days after our notice, with your reasons. "Subprocessors" in the DPA explains what happens next, including your right to end the affected service with a pro-rata refund if we can't resolve your objection.
7.4 Records
The change log below records every change to this page, with its date.
8 · Contact
KoalaFix Pty Ltd (ABN 99 696 245 959, ACN 696 245 959), 425 Smith St, Fitzroy VIC 3065, Australia.
- Questions about Subprocessors, subscriptions and objections: support@koalafix.com
- Security reports: support@koalafix.com
9 · Change log
| Date | Version | What changed |
|---|---|---|
| 28 October 2026 | 1.0 | Named X (the X Pixel) beside Google, Meta and LinkedIn among the website pixels (section 6). |
| 28 October 2026 | 1.0 | First version for the hosted KoalaFix product. It replaces the previous version of this page, which covered our earlier product. |