Sub-processors

Providers that process personal data

Google LLC (Google Cloud)

Hosts our server, database, uploaded files and backups. Our contract is with Google Cloud India Pvt. Ltd.

Data: all account data and your records · Location: India (Mumbai); encrypted backups in the United States

Cloudflare, Inc.

Delivers every request to our site, filters attacks and runs our domain’s name servers (DNS).

Data: IP address, browser and the pages requested · Location: edge servers worldwide

Amazon Web Services (Amazon SES)

Sends our emails: sign-in codes, receipts, renewal reminders and summaries to you, notices to you about your customers (an invoice was viewed, a quotation was accepted, a message arrived), and the one-time code your customer asks for to open their page.

Data: names, email addresses and the content of those emails, including your customers’ names and email addresses · Location: India

Google LLC (Google Workspace)

Holds our mailbox: the emails you write to us and our replies.

Data: names, email addresses and the content of those emails · Location: United States and other Google data centres

Cashfree Payments India Pvt. Ltd.

Processes our subscription and advertising payments and auto-renew mandates from India.

Data: name, email, phone, amount, masked payment method · Location: India

PayPal Payments Pvt. Ltd. and the PayPal group

Processes our subscription and advertising payments from outside India. You pay on PayPal’s own page.

Data: order number, plan and amount from us; the payment details you give PayPal · Location: United States and other PayPal data centres

Google LLC (Google Analytics)

Measures visits to our public pages, only for visitors who accept analytics. Its script never runs inside the app; for those visitors our server reports sign-up, first invoice and plan payment steps.

Data: pseudonymous visitor ID, pages viewed, browser, approximate location, plan orders (order number, plan, amount) · Location: United States

Lookups that carry no personal data

These services receive a single code or nothing about you, so they are not sub-processors, but we list them so the picture is complete.

Razorpay IFSC service (ifsc.razorpay.com)

Fills in the bank name when you enter an Indian IFSC.

Data sent: the IFSC code only

PIN and postal codes (api.postalpincode.in, api.zippopotam.us)

Fill in the city and state when you type a PIN or postal code.

Data sent: the postal code and country only

Exchange rates (open.er-api.com)

Provides daily exchange rates for invoices in other currencies.

Data sent: none about you

European Commission (VIES) and HM Revenue & Customs

Check an EU or UK VAT number: yours at checkout, and a customer’s when you save them or press Check now.

Data sent: the VAT number only

Domain name lookups (DNS)

Check that a payment link you save points to a real site, and find which mail service your email address uses.

Data sent: the domain name only

Changes to this list

Before we add or replace a provider that will process the records you keep about your customers, we email the owner of every account at least 15 days in advance and update this page. You can object as our data processing addendum describes. Questions: hello@theopenngroup.com.