How we use sub-processors
A sub-processor is a company that processes personal data on our behalf. We engage each one under a written agreement that requires them to protect your data, to use it only to provide their service to us, and to apply appropriate security measures. We keep the list short on purpose. The providers marked optional are only used when you choose a feature that needs them (for example the AI features), and providers marked as processing data outside the EEA do so under the safeguards described in our Privacy Policy.
Current sub-processors
| Provider | Purpose | Data it handles | Location |
|---|---|---|---|
| Supabase | Authentication, database, realtime sync, backend functions and cloud backups | Your account and logbook data | European Union |
| Cloudflare | Website and web-app delivery, edge routing, contact-form email, and storage of app update files (Windows installers only) | Website requests and IP address; contact-form emails. No logbook data. | Global edge network |
| Apple | App Store purchases and receipts, Sign in with Apple, and Apple Maps for route maps | Purchase metadata; Apple sign-in token; map requests | United States / global |
| Optional AI (Gemini) for photo/PDF import and chat; Google Play billing (Android); Google Sign-In; and reCAPTCHA on the contact form | Extracted logbook text/image for AI (optional); purchase tokens; sign-in token; contact-form token and IP | United States / global | |
| DeepSeek | Optional AI for spreadsheet import and chat | Extracted logbook text / an aggregated briefing (optional) | Outside the EEA |
| Stripe | Payments for web and Windows purchases | Email, customer and subscription metadata; card details entered on Stripe's own pages (never on ours) | United States / EU entity for EU customers |
| Resend | Sending transactional billing emails | Recipient email address and email content | United States |
| Simple Analytics | Cookieless website analytics (public website only) | Aggregate page views; no personal data or cookies | European Union |
Changes to this list
We update this page when we add, replace or remove a sub-processor. The “last updated” date at the top reflects the current list. Organisation customers can ask to be notified of material changes under our Organisation and Data-Processing Terms.
Contact
Questions about our providers? Email legal@rotorlog.com. See also our Privacy Policy.