Sub-processors

Buildlr Ltd uses the service providers below ('sub-processors') to process customer workspace data on its behalf under the Data Processing Agreement (DPA). This page is the authoritative, current sub-processor list referenced by section 5 and Annex III of the DPA.

• Hetzner Online GmbH - hosting, storage, backups - Germany (EU).
• OpenRouter, Inc. - AI routing (primary route; restricted to zero-data-retention, no-training endpoints) - US - EU Standard Contractual Clauses.
• Anthropic - AI processing (fallback when no compliant endpoint is available) - US - DPA with SCCs.
• Functional Software, Inc. (Sentry) - error monitoring - EU (Frankfurt ingest); US support access under SCCs.
• Twilio Inc. (SendGrid) - transactional email delivery - US - EU-US Data Privacy Framework.
• CloudMailin - inbound email receipt (lead intake) - UK/US - SCCs.
• Google LLC (Firebase Cloud Messaging) - push notification delivery (native apps) - US - EU-US Data Privacy Framework.
• Cloudflare, Inc. - bot protection on public lead forms - US - EU-US Data Privacy Framework.

Engaged only on your instruction when you connect them; the provider acts as your own processor or as an independent controller under its own terms.

• Fortnox AB - accounting integration - Sweden (EU).
• Intuit Inc. (QuickBooks) - accounting integration - US - EU-US Data Privacy Framework.

Map display and address search load content directly from the OpenStreetMap Foundation: your device requests map tiles and geocoding results straight from OpenStreetMap servers, which receive the search text and your IP address as an independent controller under its own privacy policy. This traffic does not pass through Buildlr's servers, so the OpenStreetMap Foundation is not a sub-processor.

Providers that process personal data solely for Buildlr's own operations as controller (e.g. Stripe for Buildlr's billing, Vonage for signup SMS verification) are not sub-processors of workspace data; they are disclosed in the Privacy Policy.

We give customers at least 30 days' notice by email before adding or replacing a sub-processor, and update this page at the same time. Customers may object on reasonable data-protection grounds as set out in section 5 of the DPA.