1. Who processes data for us
These companies process personal data on our instructions to run Rootpanther. Each one gets only what it needs, under a contract that requires it to protect the data. Our privacy policy explains what we collect and why.
| Company | What they do | Data | Where |
|---|---|---|---|
| Microsoft (Azure) | Hosting for the app, the API, the labs, our database and file storage | All account, lab, billing and support data we hold | Netherlands (West Europe region) |
| Resend | Sending our emails: sign-in links, security notices and billing messages | Your name, email address and the content of those emails | Sent from Ireland. Resend is based in the United States. |
| Google (Workspace) | Our company email, including support and billing mailboxes | Emails you send to us and our replies | United States and Europe |
| Anthropic | The AI models behind Onyx | Your questions to Onyx and the lab context sent with them | United States |
| Cloudflare | DNS for our domains. Your traffic to Rootpanther does not pass through Cloudflare. | None of your account data | Global |
2. Payments
Stripe processes your payments as the merchant of record. It collects your card and billing details itself and handles them under its own privacy policy, so it acts as an independent controller rather than as our subprocessor. We receive your plan, billing status, billing address and your card's brand and last four digits.
3. Sign-in providers
If you choose to sign in with Google, Microsoft or GitHub, that company confirms who you are and shares your name and email address with us. If you sign in with an email address and password, none of them are involved.
| Company | Used when | Shared with us |
|---|---|---|
| You sign in with Google | Account ID, name and email address | |
| Microsoft | You sign in with Microsoft | Account ID, name and email address |
| GitHub | You sign in with GitHub | Account ID, name, username and email address |
4. IP geolocation
The devices you sign in from are labelled with an approximate city, so you can spot a sign-in you do not recognise. The city comes from a database we download and run on our own servers, so your IP address is not sent to anyone for this.
IP geolocation by DB-IP, licensed under Creative Commons Attribution 4.0.
5. Changes to this list
When we add or replace a subprocessor, we update this page and the date at the top. Team plan managers are emailed 30 days before a new subprocessor starts.
Questions go to privacy@rootpanther.com.