Legal
Sub-processors
Every company that processes personal data for us, what they receive and where.
In short. We use a small number of specialist providers to run Regimate. Each one gets only what it needs, under a contract that requires it to protect the data. We don't use advertising networks or third-party analytics.
This list forms part of our Privacy policy and our Data processing addendum. We'll update it at least 30 days before a new sub-processor starts handling Enterprise customer data. To be told about changes by email, write to privacy@regimate.app with the subject “Sub-processor updates”.
1. Sub-processors
| Provider | What it does for us | What it receives | Location |
|---|---|---|---|
| Northflank Ltd | Runs our application servers, web gateway and Redis | All platform data while it's being processed; Redis holds rate-limit and lockout counters | UK / EEA |
| Neon, Inc. | Managed PostgreSQL database | Account, item, message, property, organisation and billing records | UK / EEA |
| [CONFIRM: Cloudflare, Inc. (R2) or Amazon Web Services (S3)] | Private file storage | Item photos, proof-of-ownership documents, finder and incident photos, asset photos | UK / EEA |
| Resend | Sends our emails | Recipient email addresses and email content, such as item names, message excerpts, finder first names, codes and signed links to photos | United States |
| Stripe | Payments, subscriptions, invoices and tax | Name, email, organisation or company name, billing address, VAT number, card details and our internal account IDs | UK, EEA and United States |
| Anthropic, PBC | AI moderation and the Regi assistant | Message text (with a finder's first name if given), item names and descriptions, thank-you notes, Emergency Access replies, messages to organisations (with any reply-to details), finder and incident photos, and Regi conversations | United States |
| Expo (650 Industries, Inc.) | Delivers push notifications to the iPhone and Android apps, through Apple and Google | Push tokens and notification text, such as item names and up to 120 characters of a message | United States |
| Browser push services (Apple, Google, Mozilla, Microsoft) | Deliver web push notifications to your browser | Your browser's push address and an encrypted notification | Varies by browser |
| Functional Software, Inc. (Sentry) | Crash reporting for the mobile apps, when enabled | Crash details, device information and your user ID | United States |
| IONOS | Hosts this website (regimate.app) | Contact form messages and standard server logs | UK / EEA |
2. Other services your device connects to
These providers aren't processing data for us, but your browser or app connects to them directly when you use certain features, so they receive your IP address and the information listed.
| Provider | When | What it receives |
|---|---|---|
| Google Fonts | Loading this website and our web apps | Your IP address and browser details |
| CARTO and OpenStreetMap | Viewing maps in the web app | Your IP address and the map area you view |
| OpenStreetMap Nominatim | Searching for an address, or printing a lost poster with a location | Your IP address and the search text or coordinates |
| Google and Apple | Signing in with Google or Apple | Your sign-in with them, under their own privacy policies |
| Google Wallet and Apple Wallet | Adding an item pass to your wallet | Google Wallet receives the pass contents from your browser. Apple Wallet passes are created by us and nothing is sent to Apple. |
| Apple App Store and Google Play | Downloading the app | Covered by their own terms and policies |
3. Transfers outside the UK
Where a provider processes personal data outside the UK, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for certified providers), or on the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. See section 8 of our Privacy policy.