Skip to content
Rent RideRent Ride

Subprocessors

Last updated 6 September 2026

To provide the Rent Ride platform and services, Resurf LLC utilises certain third-party subprocessors. Each is engaged under a written contract imposing data protection obligations no less restrictive than those set forth in our Data Processing Agreement, save where an entry below states otherwise. This page details our current subprocessors and forms part of that agreement.

Infrastructure & Core Services

These vendors provide the foundational cloud infrastructure, hosting, database, and storage capabilities required to operate the platform.

Supabase, Inc. (United States)

Function: Application database, user authentication, and secure file storage. Processes account records, business data, and renter documents.

Vercel Inc. (United States)

Function: Application hosting, edge network delivery, and request transit processing, including IP addresses and operational metadata.

Amazon Web Services, Inc. (United States)

Function: Transactional email dispatch (Amazon SES, United States for customer mail and Ireland for authentication mail), delivery and complaint notification (Amazon SNS), and object storage for the images embedded in our emails, which a recipient’s mail client fetches, so the recipient’s IP address reaches that host when images are displayed.

Billing & Payments

These services handle financial transactions, subscription billing, and merchant payment processing.

Stripe, Inc. (United States)

Function: Subscription management and payment processing for platform fees. Cardholder data is collected directly on Stripe-hosted secure pages.

Product Analytics & Observability

One provider, doing two jobs that used to belong to two. It measures how the product is used, which is how we decide what to build, and it receives the diagnostic report when something in the application fails, which is how we find out that it did. Both are listed together because both are the same company holding the same records.

PostHog, Inc. (United States)

Function: Product analytics and session replay. Records which pages and features are used, together with the technical facts of a request (a coarse location derived from the network address, the browser, and the referring page) and associates them with an account identifier once a user has signed in. Events are sent to our own domain and forwarded to PostHog from our servers, so the browser never contacts them directly. Session recordings are processed as well, with page text and field values masked in the browser before a recording is sent, so what PostHog receives is the layout of a page and the interactions with it rather than the contents of a screen. It also receives application error reports: the technical description of a fault and the trace of where in our code it happened, carrying the account identifier of whoever hit it but not the data they were working on.

Authentication Providers

Engaged only where a user chooses to sign in with it rather than with a password. We receive a verified identity back; we send nothing to them otherwise.

Google LLC (United States)

Function: Optional single sign-on. Returns the display name, verified email address, and avatar of an account holder who chooses this route. Processing is governed by Google’s own terms with that user.

Specialized & Limited-Purpose Services

These services perform specific auxiliary functions with restricted data access.

Cloudflare, Inc. (United States)

Function: Optional DNS records publication, used exclusively when a business customer authorizes it, to write that customer’s own email authentication records to its own domain. Off unless requested.

ipwho.is

Function: A single IP-to-country lookup made once during onboarding, to preselect the country and currency on the setup form. It is skipped where our hosting provider has already supplied a country for the request, which is the usual case in production. This is a free public endpoint with no account and no data processing contract, which is the one exception to the statement at the top of this page; the only personal data it receives is the IP address of the request, and it receives nothing else at any other time.

Data Storage & International Transfers

  • Our database, file storage, application hosting, product analytics, and the mail sent on behalf of business customers are located in the United States.
  • The authentication messages sent when a user signs in, resets a password, accepts an invitation, or changes an email address are relayed through Amazon SES in Ireland, so those carry a recipient email address into the European Union.
  • Transfers of personal data originating from the EEA, UK, or Switzerland rely on approved legal transfer mechanisms, including Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum.

Updates and Notifications

  • We update this page prior to engaging any new subprocessor that handles Customer Data.
  • Any customer who asks to be notified receives advance notice at least thirty (30) days prior to the engagement of a new subprocessor, and may object on reasonable data protection grounds as set out in the Data Processing Agreement.

Contact Information

For inquiries regarding our subprocessor list or to request formal documentation for procurement reviews, contact our team.

Data Protection Inquiries hello@rentride.app

privacy@rentride.app