LEGAL
Subprocessor List
Last updated: July 6, 2026
Ruunly uses the vendors below to help us deliver the service. This list is incorporated by reference into Ruunly's Data Processing Addendum. Under our DPA, we'll give tenants notice at least 30 days before onboarding any new subprocessor and honor timely written objections.
Every vendor below is under a written data processing agreement (or equivalent) with Ruunly. Card primary account numbers (PANs) never touch Ruunly servers or any vendor other than Stripe.
| Vendor | Purpose | Data processed | Location |
|---|---|---|---|
| Stripe, Inc. | Payment processing, Stripe Connect onboarding, subscription billing, refunds, disputes, fraud prevention | Customer name, email, billing address, card/bank tokens, transaction amounts | United States |
| Block, Inc. (Square) | Payment processing and payment tracking for tenants who connect Square | Transaction metadata, customer names, payment amounts — sent only if tenant connects Square | United States |
| Plaid Inc. | Bank account connections and transaction sync for payment tracking | Bank account metadata and transactions — sent only if tenant connects a bank account | United States |
| Supabase, Inc. | Authentication (email + magic link), session management, auth emails | Authentication credentials, email, session metadata | United States |
| Cloudflare, Inc. | CDN, DNS, DDoS protection, Cloudflare R2 file storage, custom-domain SaaS | Request metadata (IP, headers), file uploads (signed URLs), DNS | United States |
| Hetzner Online GmbH | Application and database hosting | All application data at rest (encrypted) | Germany |
| Coolify (self-hosted) | Deployment and hosting management on Ruunly-managed infrastructure | Environment configuration, service logs | Ruunly-managed infrastructure |
| Resend (Resend.com, Inc.) | Transactional email delivery (primary) | Recipient email, email content, delivery metadata | United States |
| SendGrid (Twilio, Inc.) | Transactional email delivery (fallback) | Recipient email, email content, delivery metadata | United States |
| Zoho Corporation | Support email hosting (messages sent to Ruunly support addresses) | Email content and metadata of messages sent to Ruunly support | United States |
| Telnyx, LLC | SMS delivery (primary) | Recipient phone number, message content, delivery status | United States |
| Twilio, Inc. | SMS and voice delivery | Recipient phone number, message content, call metadata, delivery status | United States |
| PostHog, Inc. | Product analytics (consent-gated) | Consent-based event telemetry: page views, feature usage; anonymized via distinct IDs | United States |
| Inngest, Inc. | Background job scheduling and retry infrastructure | Event payloads (may include tenant and customer IDs; no card PAN) | United States |
| Sentry (Functional Software, Inc.) | Error tracking and diagnostics (PII scrubbed) | Error stack traces, request metadata with PII automatically scrubbed | United States |
| OpenWeatherMap (OpenWeather Ltd) | Weather data (powers weather alert automation) | Geographic coordinates (for weather lookup; no customer identifiers) | United Kingdom |
| Namecheap, Inc. | Domain registration (managed domains on Pro/Growth tiers) | Domain registrant details (owner-provided) | United States |
| Anthropic, PBC | AI content generation (website copy, review response drafts, blog assistance) | Prompts we construct from tenant input; no card or health data; model runs are not used for training per API terms | United States |
| OpenAI, L.L.C. | Content moderation of published pages | Published page text submitted for moderation scanning; no customer payment data | United States |
| Google LLC | Calendar and Business Profile integrations, reviews sync (tenant-enabled); Web Risk URL scanning; Analytics/Ads measurement | Integration data for tenant-connected Google services; published URLs for Web Risk scanning; site usage and ad measurement events | United States |
| Meta Platforms, Inc. | Ad measurement for Ruunly marketing pages | Ad click and conversion measurement events from Ruunly marketing pages | United States |
| Intuit, Inc. (QuickBooks Online) | Accounting sync for tenants who opt in (Growth tier) | Invoice metadata, payment amounts, customer names — sent only if tenant connects QBO | United States |
Notice of changes. When we plan to add a new subprocessor, we'll email the primary contact on your tenant account at least 30 days before the change takes effect. You can object in writing before the change; if the objection cannot be resolved, you're entitled to terminate per the DPA.
Questions? Email [email protected] or see the DPA for the full commitment text.