Sub-Processors
Effective: 12 May 2026
To deliver our platform services we rely on specialised providers. With each of these sub-processors we have a Data Processing Agreement pursuant to Art. 28 GDPR. Cross-border transfers are covered by EU Standard Contractual Clauses (SCC) or the EU-US Data Privacy Framework.
| Provider | Location | Purpose | Data types | Third-country transfer |
|---|---|---|---|---|
Supabase Inc. Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992 | USA / EU hosting (Frankfurt) | Database, authentication, file storage, edge functions | All platform data | SCC + DPF; DB region eu-central-1 |
Cloudflare Inc. Cloudflare Inc., 101 Townsend St, San Francisco, CA 94107, USA | USA / global edge | CDN, DDoS protection, static hosting, Workers | IP address, user-agent, accessed URLs | SCC + DPF |
Resend Inc. Resend Inc., 2261 Market Street #4818, San Francisco, CA 94114, USA | USA | Sending transactional emails (invitations, notifications) | Email address, name, language, email content | SCC + DPF |
Stripe Payments Europe Ltd. Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland | Ireland (EU) | Payment processing, invoicing (once billing is activated) | Billing data, customer token, payment status (no card data on our side) | No third-country transfer |
Google Ireland Ltd. Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland | Ireland (EU) — Google Workspace | Business email communication (hello@realpilot.io) | Email content, attachments, recipient addresses, calendar | SCC + DPF; EU-region data hosting available |
Changes
When adding new sub-processors or replacing existing ones, we inform active contractual partners at least 30 days in advance by email. You may object to the change within that period — if the change is essential to operating the platform, we reserve the right of special termination.
Questions?
For questions about our sub-processors or data processing in general, contact privacy@realpilot.io.
