Subprocessors
Last updated: 12 October 2026
The service providers that may process personal data our customers entrust to QRiva, under our Data processing agreement.
1.Current subprocessors
| Provider | What it does | Personal data | Where | When |
|---|---|---|---|---|
| Supabase, Inc. | Database, sign-in and file storage | All workspace content, account data, scan and visit events, form answers, uploads, leads | Frankfurt, Germany (AWS eu-central-1) | Always |
| Vercel, Inc. | Application hosting and content delivery | Requests passing through the service, including the network address of each request while it is handled | Application servers in Frankfurt, Germany; static files delivered from a global network | Always |
| Plus Five Five, Inc. (Resend) | Sending e-mail: sign-in links, alerts, reports, notifications | Recipient e-mail address and the content of the message | Sending region in Ireland (EU); company in the United States | Always |
| Stripe Payments Europe, Ltd. | Subscription billing, invoices and payment methods | Billing contact, billing address, VAT number, payment details (entered directly with Stripe) | Ireland (EU), with processing in the United States | When a workspace pays for a plan |
| Anthropic, PBC | AI features: the in-app assistant and AI drafts of forms and product passports | The prompt and the content the user chooses to include | United States | Only when someone in the workspace uses an AI feature |
| Functional Software, Inc. (Sentry) | Monitoring technical errors in the application | The technical description of an error, the page or route where it happened, browser and device type; no network addresses, cookies or request contents | Frankfurt, Germany (EU); company in the United States | Always |
2.Services that receive no personal data
Google Safe Browsing receives the web addresses of destinations so they can be checked for threats. Upstash keeps a short-lived copy of code addresses and their destinations so printed codes keep resolving during an outage. Threat lists from URLhaus and OpenPhish are downloaded to QRiva. No personal data about customers or visitors is sent to these services.
Services a customer connects itself, such as HubSpot, Google Sheets, Slack, Stripe for form payments, analytics or advertising tags, or its own webhooks, are not our subprocessors. They receive data on the customer's instructions and under the customer's own agreement with them.
3.Safeguards
Each subprocessor is bound by a written agreement with data protection obligations no less protective than those in our Data processing agreement. Where a subprocessor processes personal data outside the European Economic Area, the transfer relies on an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework for certified companies, or on the European Commission's standard contractual clauses.
4.Changes to this list
We update this page before a new subprocessor starts processing customer personal data, and the date at the top changes with it. Customers who want to be told by e-mail can ask at support@qr-iva.com. Objections are handled as described in section 7 of the Data processing agreement.