Subprocessors and Recipients
Recipient and subprocessor review inventory. This list does not itself authorise a subprocessor. Customer authorisation is governed by the customer's executed DPA. Publishing this list is not evidence that every provider contract and processing location has been confirmed.
Review version date: 2026-10-15
How to read this list
Well-Clean is operated by Individual Entrepreneur Alexander Netesov, based in Moscow, Russia. Contact +7-495-142-00-62; Telegram: https://t.me/welldone_chat_bot about recipients or a customer processing agreement, and +7-495-142-00-62; Telegram: https://t.me/welldone_chat_bot for service support.
A provider serving our own website or business-contact purposes is not automatically a subprocessor of customer work content. A subprocessor is a separate provider we engage to process that content on the customer's behalf. The final role follows the actual data flow and contract, not the brand name or this table heading.
The list identifies specific routes observed in the reviewed implementation. It does not authorise every feature, certify provider contracts, or claim a storage country from a hostname or IP address. The separate web panel and mobile app require their own complete deployment inventory. See the Privacy Notice, Cookie Policy and unexecuted DPA draft.
English marketing website
| Recipient or route | Function and data | Location and status |
|---|---|---|
| Timeweb website hosting | WordPress website delivery and associated request/technical data. | The website hosting target is confirmed. Contracting legal entity, datacentre, backup and support-access countries require verification; this is not a verified customer-app hosting inventory. |
PostHog US Cloud, through panel.well-clean.online/ph | Optional English-site pageview and specifically instrumented event analytics, browser identifiers and request/device data. Session replay and automatic interaction capture are disabled on the English pages. | The configured route points to US Cloud. Actual account agreement, retention and onward-processing safeguards require confirmation. Disabled on the English marketing pages while controller-side legal checks are incomplete. Later activation also requires an analytics choice; the proxy is not an EU-storage assurance. |
| Yandex Metrica, counter 96676341 | Optional page and explicitly instrumented event measurement, browser/request metadata and identifiers through the Metrica service. | Disabled on the English marketing pages. Provider legal entity, processing countries, retention and contract require verification before activation. Webvisor is disabled on the English pages; legacy counter 42415274 is not enabled there. |
Embedded support relay at tg-bot.welldone.su | Optional chat session identifier, optional user name, messages and connection metadata. | The component and relay route are observed, but the embedded component is disabled on the English marketing pages. Hosting, authorised access, retention and any downstream Telegram disclosure require confirmation. A visible chat button does not by itself authorise background session creation. |
| External font and requested-resource hosts | The reviewed website loads jQuery from code.jquery.com and includes font resources at s0.wp.com; some content templates use Google Fonts or libraries from cdnjs.cloudflare.com. A browser request can disclose IP/device and requested-resource metadata. | The host set can vary by content template and must be kept current for the actual English routes. These are content-delivery routes, not permission to add analytics or a claim that every host is used on every English page. |
Customer service routes requiring confirmation
| Observed category or implementation | Relevant data | Unresolved execution condition |
|---|---|---|
| Application/API/database and file hosting | Accounts, worker identities, tasks, answers, work photographs and operational logs. | Reviewed sources place application/database and file processing on server infrastructure associated with Russia. The actual hosting legal entity, physical countries, replicas, backups and remote-access countries are not independently confirmed. No EU-only or Russia-only guarantee is made. |
| UniSender Go transactional/PDF delivery route | Recipient email, requested service-message content and PDF attachments where that service is activated. | A dated operational record and code identify this route. The current EN activation, contracting legal entity, processing countries, retention and agreement must be confirmed before authorising the relevant customer data. |
| Legacy DashaMail/Timeweb mail and mailbox reconciliation | Historical delivery correlation, recipient/message records and sent-mail copies. | Legacy handling is present in the reviewed service. Its current scope and necessary retained copies must be separated from any newly approved delivery provider; an unsubscribe is not erasure of delivery correlation. |
| Support/administrative Telegram relay | Service and contact notifications can include organisation/contact details; user support can include message content. | Confirm which notifications are enabled, relay hosting, downstream recipients, authorised personnel, contract/transfer basis and retention. A past description of a European relay is not current location proof. |
Mobile diagnostics, remote notification services, account security tools and payment functions are outside this English-website inventory and require a separate current assessment before their notices or agreements can be relied on. A dependency in source code alone is not evidence that a vendor receives data in an installed release.
Approval and change process
Our own website analytics and support
Before enabling an optional website analytics or support vendor, we must confirm our controller-side processing basis and, where international-transfer rules apply, the actual countries, applicable transfer mechanism, assessment and safeguards. A visitor's optional choice is an additional requirement; it is not a substitute for those arrangements or explicit consent to a transfer derogation. Nor does the customer's work-content DPA authorise our own website purposes. Contact +7-495-142-00-62; Telegram: https://t.me/welldone_chat_bot for the actual route's applicable mechanism and how to obtain a copy of its safeguards.
Customer work data
Before accepting EEA, UK or Swiss customer work data, the parties must complete the legal-entity and country map, provider data-processing agreements, security/retention schedule and any required transfer mechanism and assessment. Until then this list does not provide legal cover for those disclosures and the customer must not submit that data under the draft.
Once an applicable DPA is executed, the authorised list and written change procedure govern additions and replacements. Under general authorisation, advance notice must provide a meaningful opportunity to object before a new subprocessor receives the covered data. No automated subscription to change notices is represented as operational by this draft. Request the applicable list and procedure from +7-495-142-00-62; Telegram: https://t.me/welldone_chat_bot before agreeing.
English-site optional analytics or support choices are not customer DPA authorisation, and a customer DPA is not a visitor's cookie choice. We will revise this list's effective version when the documented inventory changes.