Sub-processors
This is the current list of sub-processors — third-party providers that process personal data on our behalf under Art. 28 GDPR data processing agreements. It is referenced by our Privacy Policy (§7) and updated whenever a provider is added or removed, without the policy itself being re-issued.
Transfer safeguards. Where a provider processes data outside the EU/EEA we rely on the EU–US Data Privacy Framework where the recipient is certified, or the European Commission's Standard Contractual Clauses otherwise, with supplementary measures — see Privacy Policy §8. Where a provider is marked “not a DPF participant”, we checked the U.S. Department of Commerce participant register (active and inactive) and found no listing, so the transfer rests on Standard Contractual Clauses rather than the Framework; a transfer impact assessment for these providers is being completed. Register last checked 31 July 2026; each provider's agreement is being confirmed against its current data processing terms.
Content processing & AI
| Provider | Purpose | Location | Transfer basis |
|---|---|---|---|
| Google Cloud Vertex AI (Gemini) | Recognition of uploaded content and email; text extraction; detection of personal details for removal | EU region | EU–US DPF (Google LLC, active) |
| Google Cloud Vision | Optical character recognition on images | Global — no region pinned | EU–US DPF (Google LLC, active) |
| Anthropic (Claude) | AI chat over pseudonymised insights (business-customer platform); internal tooling | US | SCCs — not a DPF participant |
| OpenAI | Search-query embeddings over pseudonymised insights | US | SCCs — not a DPF participant |
Email collection & rendering
| Provider | Purpose | Location | Transfer basis |
|---|---|---|---|
| Google (Gmail) | Hosts your connected mailbox. The app reads it on your device via IMAP; server-side, the Gmail API reads shared messages and writes labels back | Google (US / EU) | EU–US DPF (Google LLC, active) |
| Oxylabs | Proxy used while rendering email screenshots | EU (Lithuania) | EU — no transfer |
| Scrapfly | Proxy used while rendering email screenshots | US | SCCs — not a DPF participant |
Storage, hosting & infrastructure
| Provider | Purpose | Location | Transfer basis |
|---|---|---|---|
| Neon | Managed Postgres database — all stored data | EU (Frankfurt, aws eu-central-1) | EU residency; DPF + SCCs (Neon / Databricks) |
| Google Cloud Storage | File and image storage | EU | EU–US DPF (Google LLC, active) |
| Vercel | App and API hosting; request logs | US | EU–US DPF (Vercel Inc., certified) |
| Dagster+ | Data-pipeline orchestration | US (EU region available — migration planned) | SCCs — not a DPF participant |
| Pusher | Realtime notifications — contentless signals only | EU cluster | EU — no content transits; vendor-side access: UK adequacy (Art. 45 — Pusher Ltd, UK) |
Communication, support & diagnostics
| Provider | Purpose | Location | Transfer basis |
|---|---|---|---|
| Resend | Transactional email delivery | US | EU–US DPF (certified 2025) |
| Intercom | Support chat | US (no EU region set) | EU–US DPF (Intercom, Inc., active) |
| Mixpanel | Product analytics (consent-based) | EU endpoint (operational metadata still US) | EU residency; EU–US DPF (Mixpanel, Inc., certified) + SCCs Module 2 |
| Google Firebase | Push notifications (FCM), app analytics, performance monitoring | Google — global, no region selection offered | EU–US DPF (Google LLC, active) |
| Google Firebase Crashlytics | Crash and non-fatal error reports: stack trace, device model, OS and app version, Crashlytics installation identifier | Google — global, no region selection offered | EU–US DPF (Google LLC, active) |
| Sentry (Functional Software, Inc.) | Error monitoring — failed app-to-server requests and server-side exceptions | EU region (Frankfurt) | EU residency; EU–US DPF (Functional Software, Inc., self-certified) as backstop |
Rewards & payouts
PayPal is not a sub-processor. When we pay you out via PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg), PayPal handles your payment data as an independent controller under its own privacy notice — not on our instructions. We disclose your payout identifier and the amount so the payment can be made. For its own transfers to the US, PayPal relies on controller-to-controller Standard Contractual Clauses (Module 1) governed by Luxembourg law.
Not sub-processors
Our content-review tooling is self-hosted on our own infrastructure and reviewers are our own staff bound by confidentiality, so no third party is involved. Our web fonts and CAPTCHA arrangements are covered in Privacy Policy §14.
Questions or objections
To ask about a provider on this list, or to object to a particular processing activity, contact privacy@rewado.io.