LEGAL
Subprocessor List
Last updated: July 25, 2026
Ruunly uses the vendors below to help us deliver the service. This list is incorporated by reference into Ruunly's Data Processing Addendum. Under our DPA, we'll give tenants notice at least 30 days before onboarding any new subprocessor and honor timely written objections.
Every vendor below is under a written data processing agreement (or equivalent) with Ruunly. Card primary account numbers (PANs) never touch Ruunly servers or any vendor other than Stripe.
| Vendor | Purpose | Data processed | Location |
|---|---|---|---|
| Stripe, Inc. | Payment processing, Stripe Connect onboarding, subscription billing, refunds, disputes, fraud prevention | Customer name, email, billing address, card/bank tokens, transaction amounts | United States |
| Block, Inc. (Square) | Payment processing and payment tracking for tenants who connect Square | Transaction metadata, customer names, payment amounts — sent only if tenant connects Square | United States |
| Plaid Inc. | Bank account connections and transaction sync for payment tracking | Bank account metadata and transactions — sent only if tenant connects a bank account | United States |
| PayPal Holdings, Inc. | Payment tracking for tenants who connect a PayPal account; affiliate payouts where an affiliate elects PayPal as their payout method | Transaction metadata, payer names, payment amounts — sent only if a tenant connects PayPal; payout recipient email and amount where PayPal is the elected affiliate payout method | United States |
| Supabase, Inc. | Authentication (email + magic link), session management, auth emails. Supabase does NOT host the Ruunly application database — application data lives in Ruunly-operated PostgreSQL. | Authentication credentials, email, session metadata | United States |
| Cloudflare, Inc. | CDN, DNS, DDoS protection, Cloudflare R2 file storage, custom-domain SaaS | Request metadata (IP, headers), file uploads (signed URLs), DNS | United States |
| Hetzner Online GmbH | Application and database hosting | All application data at rest (encrypted) | United States (Ashburn, Virginia) |
| Coolify (self-hosted) | Deployment and hosting management on Ruunly-managed infrastructure | Environment configuration, service logs | Ruunly-managed infrastructure |
| Resend (Resend.com, Inc.) | Transactional email delivery (primary) | Recipient email, email content, delivery metadata | United States |
| SendGrid (Twilio, Inc.) | Transactional email delivery (fallback) | Recipient email, email content, delivery metadata | United States |
| Zoho Corporation | Support email hosting (messages sent to Ruunly support addresses) | Email content and metadata of messages sent to Ruunly support | United States |
| Twilio, Inc. | SMS and voice delivery (primary) | Recipient phone number, message content, call metadata, delivery status | United States |
| Telnyx, LLC | Legacy SMS provider retained for rollback only. No active SMS traffic is routed to Telnyx; sending is Twilio-only unless Ruunly explicitly reverts. | Recipient phone number, message content, delivery status — only if Ruunly reverts SMS sending to Telnyx | United States |
| PostHog, Inc. | Product analytics (consent-gated) | Consent-based event telemetry: page views, feature usage; anonymized via distinct IDs | United States |
| Inngest, Inc. | Background job scheduling and retry infrastructure | Event payloads (may include tenant and customer IDs; no card PAN) | United States |
| Sentry (Functional Software, Inc.) | Error tracking and diagnostics (PII scrubbed) | Error stack traces, request metadata with PII automatically scrubbed | United States |
| OpenWeatherMap (OpenWeather Ltd) | Weather data (powers weather alert automation) | Geographic coordinates (for weather lookup; no customer identifiers) | United Kingdom |
| Namecheap, Inc. | Domain registration and email forwarding (managed domains on Pro/Growth tiers; forwards addresses like info@{tenant-domain} to the tenant inbox for carrier-verification support) | Domain registrant details (owner-provided); forwarded email envelope/routing metadata for configured forwarding addresses | United States |
| Anthropic, PBC | AI content generation (website copy, review response drafts, blog assistance) and content moderation of published pages | Prompts we construct from tenant input; published page text submitted for moderation scanning; no card or health data; model runs are not used for training per API terms | United States |
| Deepgram, Inc. | Speech-to-text transcription of audio a user records in the AI Proposal Builder | Recorded audio (walkthrough voice notes) and the resulting transcript — sent only when a user records audio in that feature | United States |
| Mapbox, Inc. | Map rendering for crew/technician location tracking, on-my-way links, and address-based quote widgets | Service coordinates and addresses; the IP address and browser user agent of visitors whose browser loads a map on a public tenant page | United States |
| Expo (650 Industries, Inc.) | Delivery of push notifications to the Ruunly mobile app via Apple and Google push services | Device push tokens and notification title/body content | United States |
| Google LLC | Calendar and Business Profile integrations, reviews sync (tenant-enabled); Web Risk URL scanning; AI image generation for website and print assets (Google Generative Language API); Analytics/Ads measurement | Integration data for tenant-connected Google services; published URLs for Web Risk scanning; image-generation prompts we construct from tenant business details; site usage and ad measurement events | United States |
| Microsoft Corporation | Outlook/Microsoft 365 calendar sync and the sign-in identity used to authorize it, for tenants who connect a Microsoft account | Microsoft account email, OAuth tokens, and calendar event details (times, titles, attendees) for the connected calendar — sent only if a tenant connects Microsoft | United States |
| sanctions.io | OFAC/sanctions-list screening of affiliates before a commission payout is released | Affiliate name, payout email, and payout country — affiliate program participants only; no End Customer data | United States |
| Meta Platforms, Inc. | Ad measurement for Ruunly marketing pages | Ad click and conversion measurement events from Ruunly marketing pages | United States |
| Intuit, Inc. (QuickBooks Online) | Accounting sync for tenants who opt in (Growth tier) | Invoice metadata, payment amounts, customer names — sent only if tenant connects QBO | United States |
Notice of changes.When we plan to add a new subprocessor, we'll email the primary contact on your tenant account at least 30 days before the change takes effect. You can object in writing before the change; if the objection cannot be resolved, you're entitled to terminate per the DPA.
Questions? Email [email protected] or see the DPA for the full commitment text.