Patronite
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Crowd8 sp. z o.o., ul. Żwirki i Wigury 16, 02-092 Warszawa, Poland (KRS 0000548195, NIP 5242777491)
Poland's creator membership platform (Crowd8 sp. z o.o.): 6.5% commission with Polish payment rails, Tpay and ING's Imoje, on AWS Frankfurt infrastructure.
Patronite offers EU hosting in Germany, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Membership platforms.
Assessment notes
Patronite is Poland's membership platform for creators, operated by Crowd8 sp. z o.o. in Warsaw, and it is the second entry in this category whose default payment rails are EU-incorporated: the fee annex to its terms names Tpay (Polish, bank transfer and BLIK, 0.8%) and Imoje (the payment service of ING Bank Śląski, recurring card payments, 1%), with PayPal as an optional third route. The platform commission is 6.5% on top. Its privacy documentation is unusually candid in one specific way: the recipients table marks the hosting provider, the office-software and mail provider, the analytics and push provider, and the marketing tools as transferred outside the EU (USA), under standard contractual clauses. That candour is worth noting, and it is also the finding: patronite.pl resolves into AWS eu-central-1 in Frankfurt, so the data is in Germany but the operator is American, and Google Analytics, Google AdSense, Microsoft Clarity, OneSignal and the Meta pixel are all present: Material. No public DPA and no named sub-processors list, which caps this at 3/5.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 10 · 8 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: No
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Patronite
Patronite is the Polish membership platform for creators, operated by Crowd8 sp. z o.o. from Żwirki i Wigury in Warsaw and registered under KRS 0000548195. Patrons support authors with recurring monthly pledges at set tiers or with one-off contributions, and authors publish members-only material against those tiers. It is the dominant platform of its kind in Poland, with a heavy weight of journalism, podcasting and commentary among its authors, and the interface is Polish only.
The payment arrangement is the part worth reading. Patronite's own commission is 6.5% of each pledge, and the fee annex to the terms names exactly three payment operators with their rates: Tpay for bank transfers, BLIK and payment slips at 0.8%, Imoje, the payment service of ING Bank Śląski, for recurring card payments at 1%, and PayPal for recurring payments at 2.9% plus 1.35 zł. Two of those three are Polish financial institutions, which means a Polish patron paying a Polish creator with BLIK never touches a US payment company at all. Alongside Patreon-style pledges, Crowd8 also operates fundraisers and one-off contributions on the same rails.
What Patronite discloses about the rest of the stack is more candid than most and, read carefully, is the audit finding. The privacy documentation includes a recipients table which marks the hosting provider, the office and mail software provider, the analytics and push provider, and the marketing tools as transferring data outside the EU to the USA, relying on standard contractual clauses under Article 46(2)(c) GDPR. Live infrastructure confirms the hosting half of that: patronite.pl resolves into AWS eu-central-1 in Frankfurt, so records sit in Germany under an American operator. The cookie table adds Google Analytics, Google AdSense, Microsoft Clarity, OneSignal and the Meta pixel, and the mail configuration shows Google Workspace and Freshdesk: Material. No individual sub-processor is named anywhere and no DPA is published. Best fit: Polish creators whose audience pays in złoty, where the local rails are both cheaper and cleaner than the alternatives.
Sub-processor map · 10
-
Amazon Web Services (AWS eu-central-1) USUnited States
Platform hosting in Frankfurt, Germany (the recipients table records the hosting provider as a US transfer)
-
Freshworks Inc. (Freshdesk) USUnited States
Support ticketing and support email (from public SPF record)
-
Google Ireland Limited (Google Analytics and AdSense) USIreland
Audience analytics and conversion measurement for advertising (consent-gated)
-
Google Ireland Limited (Google Workspace) USIreland
Corporate and support email (from public MX and SPF records)
-
Meta Platforms Ireland Limited USIreland
Facebook pixel analytics and advertising (consent-gated)
-
Microsoft Corporation (Clarity) USUnited States
Session analytics and user identification across pages (consent-gated)
-
OneSignal, Inc. USUnited States
Push notifications in the mobile app (consent-gated)
-
PayPal (Europe) S.à r.l. et Cie, S.C.A. USLuxembourg
Recurring payments via PayPal (2.9% + 1.35 PLN per transaction)
-
Imoje (ING Bank Śląski S.A.) EUPoland
Recurring card payments (1% per transaction)
-
Tpay (Krajowy Integrator Płatności S.A.) EUPoland
Bank transfer, BLIK and payment-slip contributions (0.8% per transaction)
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Amazon Web Services (AWS eu-central-1) | United States | Platform hosting in Frankfurt, Germany (the recipients table records the hosting provider as a US transfer) | US |
| Freshworks Inc. (Freshdesk) | United States | Support ticketing and support email (from public SPF record) | US |
| Google Ireland Limited (Google Analytics and AdSense) | Ireland | Audience analytics and conversion measurement for advertising (consent-gated) | US |
| Google Ireland Limited (Google Workspace) | Ireland | Corporate and support email (from public MX and SPF records) | US |
| Meta Platforms Ireland Limited | Ireland | Facebook pixel analytics and advertising (consent-gated) | US |
| Microsoft Corporation (Clarity) | United States | Session analytics and user identification across pages (consent-gated) | US |
| OneSignal, Inc. | United States | Push notifications in the mobile app (consent-gated) | US |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Luxembourg | Recurring payments via PayPal (2.9% + 1.35 PLN per transaction) | US |
| Imoje (ING Bank Śląski S.A.) | Poland | Recurring card payments (1% per transaction) | EU |
| Tpay (Krajowy Integrator Płatności S.A.) | Poland | Bank transfer, BLIK and payment-slip contributions (0.8% per transaction) | EU |
Source: the vendor’s published sub-processor list, read 10 Aug 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of Patronite
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
-
OpenTerms of Servicepatronite.pl/regulamin…
Alternatives in this category
-
CzechiaUS-LinkedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct This listing The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
United Kingdom · $12/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
FranceEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: Yes -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Herohero
Czechia
|
US-Linked | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
— |
Ko-fi
United Kingdom
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
$12/mo |
Liberapay
France
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: Yes
|
— |