Sub-processors and International Transfers

• MongoDB Atlas: The database every workspace's records live in. Receives: All data a customer stores, and account details.
• Vercel: Hosting and delivery of the website and the products, and file storage (Vercel Blob). Receives: Requests to the service, and files customers upload.
• Resend: Delivery of the service's own emails (sign-up, invitations, alerts, receipts). Receives: Recipient email address, name and the message.
• Razorpay: Taking payment for plans and add-ons. Receives: Billing contact details and payment status. Card details go to Razorpay, not to us.
• OpenAI: AI features, only when a person uses one. Receives: The question or content needed to answer, and the answer.
• GitHub: Building and publishing a company's desktop and mobile apps, only when a Super Admin presses Generate. Receives: The company's name, icon and app address. No personal data.

These are used only if a company connects them in Settings → Integrations, with its own account and keys. The company chooses them and is responsible for its agreement with them; we send data to them only as the company's automations and settings direct.

• ElevenLabs: Voice features, when a company connects it. Receives: Audio and text of a voice conversation.
• Twilio and WhatsApp Business: SMS and WhatsApp messages, when a company connects them. Receives: Phone numbers and message content.
• SMTP, Resend or SendGrid (a company's own account): A company sending email from its own address. Receives: Recipient details and message content.
• Social platforms a company connects: Publishing a company's posts and reading its analytics. Receives: Posts, media and account analytics.

Hosting and database regions are chosen when the service is deployed, and the AI, email and payment providers process data in the countries where they operate. To learn which regions are used for your workspace, write to the privacy address below.

When personal data moves from one country to another we use the safeguard the applicable law requires. For data from the United Kingdom and the European Economic Area that is an adequacy decision, standard contractual clauses or the UK International Data Transfer Agreement or Addendum. For the UAE (including DIFC and ADGM), India and Saudi Arabia we follow the transfer conditions of the Personal Data Protection Laws, the Digital Personal Data Protection Act and its rules, and the Regulation on Personal Data Transfer Outside the Kingdom. Each transfer is recorded in a register with its safeguard.

Before a provider handles customer data we check what it receives, how it protects it, where it processes it and what its security attestations say, and we bind it to data protection terms. We review providers at least once a year and when what they receive changes.

We update this page before a new provider starts handling customer data. If you object on reasonable data protection grounds, write to privacy@selfrunbusiness.com.

Data protection questions: privacy@selfrunbusiness.com.