Document status
Version: 2026-09-08-processors-v5 · Last reviewed: 2026-09-08.
Controller: ELHAKIM (PTY) LTD, company number 2021/622573/07; registered office shown in the supplied CIPC company record: 50 Von Brandis Street, Marshalltown, Johannesburg CBD, Gauteng, 2000, South Africa. Processing questions and objections: privacy@ahdna.co.
Current processors
Scroll horizontally to view every column.
| Provider and service | Role and purpose | Data | Location and evidence status | Documents |
|---|---|---|---|---|
| Hostinger VPS hosting and Node.js runtime | Hosting processor under the account terms Serve the website and APIs, routing, runtime logs, deployment and availability | HTTP requests and technical data; API payloads may transit the runtime before reaching the production database | The account-specific origin data centre has not yet been evidenced in an archivable record; no South Africa storage promise is made In production; region and DPA-acceptance evidence remain open compliance items | DPA Subprocessors |
| Hostinger Email Operational email and support/privacy mailboxes | Email-service processor under the account terms Send service notices and receive support and privacy-rights correspondence | Email addresses, message content, delivery metadata and replies | The Ahdna mailbox storage country has not yet been evidenced for this account and is not inferred from the web-server location Operationally used for request notices; email-product and region evidence remain open compliance items | DPA Subprocessors |
| Supabase Authentication and production PostgreSQL database | Processor for data controlled by Ahdna Sign-in identity, sessions, product-data storage and operational backups | Account identity and sessions, submitted membership requests, profiles, preferences, relationships, messages, safety and support data | Verified primary project region: eu-west-1 (Ireland). Backups, logs, supporting services and subprocessors can affect the transfer analysis Production project is active and healthy; DPA-acceptance evidence and the transfer assessment remain open compliance items | DPA Subprocessors |
| Cloudflare Turnstile Bot and abuse protection | Processor when protecting Ahdna; Cloudflare also describes a limited independent-controller role for improving bot detection Protect member and reviewer sign-in on the web and Android app, and the membership-request form when enabled, against bots and abuse | Technical signals such as network address, User-Agent, TLS fingerprint and sitekey/origin; Ahdna does not send form-field content to Turnstile | Globally distributed network processing; Regional Services is not guaranteed for Siteverify Used with a valid production key for sign-in, including the verification page inside the Android WebView. Sign-in protection is independent of membership-request intake; the enabled request form also uses it | DPA Subprocessors |
Outside the production schedule
The current OpenAI Sites deployment is a private owner preview, not the production intake path. Production membership data is not authorised there, so it is not presented as a direct processor for the public production path. Any change requires this schedule and the transfer notice to be updated before collection.
Local software libraries that receive no data are not listed, and unused providers are not named. Provider subprocessor lists can change; the linked current lists are reviewed regularly and before any change to collection or processing.
Ongoing compliance review
The supplied record completes the controller identity and registered-office item. Making the request form available does not claim that every contracting-entity, DPA-acceptance, Hostinger origin, mailbox-location or POPIA transfer-assessment record is complete; incomplete items are identified in this schedule and remain subject to evidence, review and update.
See the international data-transfer notice and Privacy Notice.