Legal · Subprocessors
Subprocessors
Effective date: 23 April 2026
Last updated: 23 April 2026
Version: 1.3
To deliver our products, RPTX LLC relies on a small number of
reputable service providers that may process personal data on
our behalf. Each is bound by a written agreement that requires
them to handle data consistent with our
Privacy Policy and applicable law. Where
a provider is marked
optional, it is only involved if
the relevant product feature is enabled for your workspace.
Infrastructure & hosting
| Vendor |
Purpose |
Location |
| Cloudflare, Inc.cloudflare.com |
CDN, DNS, DDoS protection, Pages hosting for rptxsoftware.com and askfolder.com marketing pages, R2 object storage for uploaded documents (AES-256 at rest by default), Email Routing, and cookieless web analytics. See our Cookies policy for analytics details. |
Global edge network; R2 storage region-configurable — DPF-certified, SCCs in place. |
| Hetzner Online GmbHhetzner.com |
Primary application compute and database hosting for AskFolder. Live customer metadata, account data, and retrieval indexes are hosted on RPTX-managed infrastructure at this provider. |
Germany. SCCs in place. |
AI / model providers
| Vendor |
Purpose |
Location |
| Google LLCai.google.dev (Gemini API — paid tier) |
Primary large-language-model inference for query answering, summarisation, and routing; also used for text embeddings. We use the paid Gemini API, which is governed by the Gemini API Additional Terms of Service and Google's Generative AI data-governance commitments: Google does not use prompts, uploads, or responses sent through the paid API to train or improve its foundation models, and stores only limited operational logs (no human review of customer content in the paid tier). We do not use the unpaid / free Gemini tier. |
USA — DPF-certified, SCCs in place. |
Additional optional enrichment providers may be enabled per
workspace on request. Where a customer enables such a
provider, the relevant vendor is listed in the workspace's
own admin console and covered by the same contractual
no-training commitments. We update this page at least 30 days
before any material customer data is sent to a new AI
subprocessor; customers on a signed DPA have a right to
object under the terms of the DPA.
Payments & invoicing
| Vendor |
Purpose |
Location |
Paddle.com Market Limited & Paddle.com, Inc.paddle.com
(Merchant of Record) |
Merchant of Record for AskFolder: card processing (PCI-DSS Level 1), tax calculation (EU VAT, UK VAT, US sales tax, GST, etc.), invoicing, refunds, and fraud controls. Paddle is the seller named on your receipt. Per Paddle's published Buyer Terms, the contracting Paddle entity for your purchase is Paddle.com, Inc. if you are in the United States and Paddle.com Market Limited if you are outside the United States. Paddle handles card data end-to-end; RPTX stores only last-four digits, card brand, and Paddle's customer / subscription identifier. |
United Kingdom / USA — DPF-certified, SCCs in place. |
Email, operations, and customer connectors
| Vendor |
Purpose |
Location |
| Resend, Inc.resend.com |
Transactional email — sign-up confirmation, password reset, billing notifications, support replies — for the rptxsoftware.com and askfolder.com domains. |
USA — SCCs in place. |
| Google LLC(Google Drive connector — folder sharing to an RPTX service account) |
Customer-authorised read-only access to the specific Google Drive folders you explicitly share with AskFolder. Your admin console shows the RPTX service-account email, and you add that email with "Viewer" (read-only) permission to each folder you want indexed — exactly the same pattern you would use to share a folder with any colleague. The service account only sees what has been shared with it; it cannot enumerate, read, edit, share, or delete any other file in your Drive, and we never store your Google account password or personal access token. You can revoke indexing at any time by removing the service-account email from the folder's Share > Manage access dialog, and the indexer stops reading on the next poll cycle. Our use of Google user data adheres to the Google API Services User Data Policy, including the Limited Use requirements. |
Global — DPF-certified, SCCs in place. |
Notifications of change
We will update this page at least 30 days in advance of adding or
replacing a material subprocessor. If you want to be notified of
changes by email, write to
[email protected]
and ask to be added to the subprocessor-change distribution list.
Customers on a signed DPA have a right to object to new subprocessors
under the terms of the DPA.
← Back to rptxsoftware.com