Providers and international processing

Hosting and database

Cloudflare, Inc. provides Cloudflare Workers, D1 database hosting and related security/delivery services. It processes account and service data needed to operate Bring With, including stored context and request/security data. Our database currently runs in Western Europe, but has no confirmed EU-only jurisdiction setting; Workers and support operations may process data internationally. Cloudflare's customer data-processing addendum and applicable transfer mechanisms govern processing: https://www.cloudflare.com/cloudflare-customer-dpa/. Its provider list is at https://www.cloudflare.com/gdpr/subprocessors/cloudflare-services/. Paid D1 Time Travel restore points are retained for 30 days.

Transactional email

Plus Five Five, Inc., trading as Resend, processes recipient addresses and necessary email content for account verification, password reset, Team invitations, contract confirmations and request acknowledgements. Sending uses the EU region; Resend states that data is stored in the US. Its provider-signed DPA is incorporated through its service terms: https://resend.com/legal/dpa. Provider list: https://resend.com/legal/subprocessors. Our current Free plan has 30-day email/log retention and 7-day backups; early removal requires a support process where the service has no deletion endpoint.

Payments

We use Stripe for hosted payment and subscription services. Stripe's published EEA terms identify Stripe Payments Europe, Limited and, for applicable regulated services, Stripe Technology Europe, Limited; its privacy documentation also identifies Stripe Technology Company, Limited for other processing activities. The responsible entity depends on the service and processing purpose. Stripe entities and service providers, including US entities, may process billing, payment, fraud and compliance information internationally. Stripe can be a processor for some services and an independent controller for regulated payment and other specified purposes. See https://stripe.com/legal/ssa, https://stripe.com/legal/dpa and https://stripe.com/legal/service-providers. Legal/compliance retention may continue after application-account deletion; deleting a Stripe customer is not a promise that all transaction records are erased.

Safeguards and changes

Applicable provider agreements describe safeguards including Standard Contractual Clauses and, where applicable, recognized adequacy arrangements such as the EU–US Data Privacy Framework. We do not claim that choosing an EU region alone removes all international transfers. Contact us for the safeguards relevant to your processing.

User-selected AI services and other connection recipients are not automatically our subprocessors. You decide which services receive your connection links and should review their policies. Business Team customers receive notice of intended additions or replacements of subprocessors under the Team data-processing agreement.