Subprocessors
The third parties Dataflag uses to deliver the service, and what each one processes.
Effective date: August 16, 2026
Subprocessor Commitments
Dataflag uses subprocessors to provide, secure, support, and bill for the Service. Each subprocessor may process Customer Personal Data only for the listed purpose and under a written contract with confidentiality, security, and purpose-limitation obligations.
Dataflag does not authorize subprocessors to sell Customer Personal Data, use Customer Content for advertising, or use Customer Content to train AI/ML models.
Current Subprocessors
| Subprocessor | Purpose | Data processed |
|---|---|---|
| Render Services, Inc. | Cloud hosting, application runtime, managed Postgres database, infrastructure logs. | Account data, workspace data, Customer Content, ratings, artifacts, and service logs. |
| OpenAI, L.L.C. | AI/model inference used to extract clauses, resolve conflicts, score ratings, and generate artifacts. | Document chunks, prompts, source text, outputs, rating artifacts, and limited metadata. |
| Stripe, Inc. | Payment processing, subscriptions, invoicing, tax, payment-method tokenization, and billing webhooks. | Billing contact, billing address, email, subscription metadata, payment references, and invoice data. |
| Postmark / ActiveCampaign, LLC | Transactional email for verification, password reset, billing notices, and customer-configured alerts. | Email address, message metadata, message content, and alert snippets. |
| Google LLC | Public website font delivery. | Visitor IP address and browser/device metadata for public page font requests. |
New Subprocessor Notice
Dataflag will provide at least 30 days' advance notice before authorizing a new subprocessor that will process Customer Personal Data, unless emergency replacement is necessary to maintain service security or availability. Customers may object on reasonable data-protection grounds by contacting hello@dataflag.io.