Subprocessors
Last updated:
BuilderPal uses the third-party service providers ("subprocessors") listed below to deliver the Service. Each one is bound by a written data-processing agreement that requires it to process customer data only on our documented instructions and to maintain appropriate security. For more on how data flows through these services, see our Privacy Policy.
This list reflects the current state of the Service. We will update it before adding a new subprocessor that handles customer personal information, and we will send notice to active customers so they can object before the change takes effect, in line with our DPA commitments.
Current subprocessors
| Subprocessor | Purpose | Data categories | Region | Engaged when |
|---|---|---|---|---|
| Render | Application and database hosting. | All workspace and account data at rest and in transit. | United States (Ohio) | Always |
| Stripe | Subscription billing and invoice payments. | Billing contact, card last 4 + brand, transaction history, IP address. | United States, Ireland | Always |
| Twilio | Outbound and inbound SMS plus browser-based voice calling. | Phone numbers, message bodies, call recordings (when enabled), call metadata. | United States | Optional / on enable |
| Resend | Transactional and quote/invoice email delivery. | Sender / recipient email, subject, body, delivery metadata. | United States | Optional / on enable |
| OpenAI | AI features: photo-to-quote, receipt OCR, AI inbox, voice command, reply drafts. Used under no-training API terms. | Prompt content for the requested action (typically a quote brief, photo, or message excerpt). | United States | Optional / on enable |
| Anthropic | Secondary AI provider for selected features. Used under no-training API terms. | Same scope as OpenAI; only sent when the feature falls back to Anthropic. | United States | Optional / on enable |
| Amazon Web Services (S3) or Cloudflare R2 | Object storage for photos, brand logos, receipts, and PDF exports. | Uploaded files (which may include EXIF/GPS metadata on photos). | United States (AWS us-east-1) or global (R2), per configuration | Always |
| Square | Alternate invoice payment processor (when enabled). | Billing contact, transaction details for invoices you collect via Square. | United States | Optional / on enable |
| Intuit (QuickBooks Online) | Optional accounting sync of invoices, customers, and payments. | Invoice and customer records you choose to sync. | United States | Optional / on enable |
| Google (Maps Platform, OAuth, Calendar, Gmail) | Satellite measurement, sign-in with Google, calendar sync, Gmail outbound email. | Address strings, OAuth tokens scoped to calendar / mail send / profile email as you authorize. | United States, EU | Optional / on enable |
| Microsoft (OAuth, Outlook / Microsoft 365) | Sign-in with Microsoft and Outlook outbound email. | OAuth tokens scoped to mail send and profile email. | Global, per Microsoft regional routing | Optional / on enable |
| Photon (Komoot public instance) | Address autocomplete and geocoding. | The address query string you type. Default deployment points at the public Komoot Photon endpoint; no account information is sent. | Germany (EU) | Optional / on enable |
| Sentry | Error and performance monitoring. | Error reports, stack traces, browser/device metadata, hashed user identifier, sampled performance traces. | United States, EU (configurable) | Optional / on enable |
| Cloudflare | DNS, edge caching, DDoS protection, and (optionally) R2 object storage. | Request metadata (IP, URL, user agent), cached static assets. | Global edge network | Always |
Affiliates
We may engage our own affiliates to provide internal support and administration of the Service. Affiliates are bound by the same security and confidentiality obligations as BuilderPal.
How to be notified of changes
To be notified by email when this list changes, write to hello@builderpal.io with the subject "Subprocessor notifications".
Contact
BuilderPal
Toronto, Ontario, Canada
Email: hello@builderpal.io