Sub-processors
Last updated: 2026-05-12
Repulabs uses the following sub-processors to operate the Service. Each is bound by a Data Processing Agreement (DPA) consistent with our Privacy Policy and applicable law. We'll notify customers at least 30 days before adding a new sub-processor that has access to personal data.
| Vendor | Purpose | Location | Data types | DPA |
|---|---|---|---|---|
| Vercel | Application hosting (Next.js) | USA (multi-region) | All | View |
| Neon | Managed Postgres + pgvector | USA (us-east-2) | All | View |
| Stripe | Payment processing, subscriptions, billing portal | USA, Ireland | Billing email, last-4 card digits, transaction history | View |
| Anthropic | Large language model (Claude) for review-reply drafting, safety classification, chatbot | USA | Review content, knowledge-base docs, chatbot turns — opt-out of training enabled | View |
| Voyage AI | Text embeddings for chatbot RAG retrieval | USA | Knowledge-base document chunks + chatbot queries | View |
| Resend | Transactional email (magic links, review requests, survey invites) | USA, EU | Recipient email, message body, delivery events | View |
| Twilio | SMS delivery for review requests + outreach | USA, EU | Recipient phone, message body, delivery events, consent records | View |
| Cloudflare | DNS, DDoS protection, edge caching for QR redirects | Global (200+ edge POPs) | IP addresses, user-agent strings, geo metadata | View |
| Google (Business Profile API) | Read reviews + post review replies for connected establishments | USA | OAuth access/refresh tokens (envelope-encrypted), review payloads | View |
Notification
To receive sub-processor change notifications, email privacy@repulabs.com with the subject "subprocessor notifications".