Subprocessors
The third-party providers we use to run Room Radius, what each is for, where it is, its data-protection role, and the transfer mechanism relied on. We give notice before adding a subprocessor that processes personal data on your behalf.
Not every provider is a “processor”. Stripe processes your payment as its own controller; Google Places and licensed contact providers are independent sources of data, not processors acting on our instructions. We say which is which below.
We do not use a third-party AI or large-language-model provider, and we set no advertising or analytics trackers — so none appear here.
| Provider | Purpose | Data | Region | Role | Transfer | Used |
|---|---|---|---|---|---|---|
| Vercel | Application hosting and compute | Data in transit through requests | United States | Processor | Standard Contractual Clauses | Always |
| Supabase | Database and authentication | Account and business-contact data at rest; login identifiers | See provider (project-configured) | Processor | Standard Contractual Clauses (if hosted outside the EEA) | Always |
| Stripe | Payments and subscriptions | Card details (direct to Stripe), email, customer reference | United States | Independent controller for payment processing | Standard Contractual Clauses | Always |
| Google (Places API) | Business discovery and geocoding | Search coordinates and queries (no contact personal data sent) | United States | Independent source | Standard Contractual Clauses | Always |
| Google (Gmail API) | Sending outreach from a connected Google mailbox; reply metadata | Mailbox access token; message headers on threads Room Radius started | United States | Processor | Standard Contractual Clauses | When you connect a Google mailbox |
| OpenStreetMap Foundation | Business data (Overpass) and in-browser map tiles | Overpass queries; viewer IP when the map loads on app pages | European Economic Area / United Kingdom | Independent source | Adequacy | Always (map tiles on app pages) |
| Brønnøysundregistrene | Norwegian company-register data | Public company/employer information | Norway (EEA) | Independent source (public register) | Not applicable (EEA) | Norway |
| Your own mail provider (SMTP/IMAP) | Sending outreach and reading reply headers, over your account | Recipient data through your own mail server | Your provider | Your provider, not a Room Radius subprocessor | Not applicable | When you connect an SMTP mailbox |
| Licensed contact-data providers | Business-contact enrichment | Business-contact details | United States | Independent source | Standard Contractual Clauses | Not active for customers in production (requires a data-licensing agreement) |
International transfers
Where a provider is outside the EEA, we rely on the mechanism shown — an adequacy decision, the EU Standard Contractual Clauses, or the EU–US Data Privacy Framework where applicable. We will confirm the current mechanism for a given provider on request.