About this list
We use a small number of providers to run Renew Reminder. Each one processes personal data only on our instructions and only for the job listed here, under a contract that requires it to protect that data. When a company uses a business workspace, these providers are our sub-processors for the workspace's data under our Data Processing Addendum.
Many providers are used only when someone uses a particular feature, and each entry says whose data it handles. Apple and Google also sell purchases made in their app stores, as independent companies under their own terms, so they are not on this list. How we use the data itself is described in our Privacy Policy, and how we protect it on our Security page.
Hosting and storage
MongoDB Atlas
All accounts and workspaces- Purpose
- Our database.
- Data
- Everything the Services store: accounts, subscriptions and bills, business workspaces and their members, Remi conversations, and connected-account tokens, which are encrypted before they are stored.
- Where
- Germany (Amazon Web Services, Frankfurt)
Contabo
All accounts and workspaces- Purpose
- Runs the servers for the Renew Reminder API, the web app and this website.
- Data
- All data the Services handle passes through these servers while it is being used.
- Where
- France (European Union)
Cloudflare (R2)
People who attach an image to a shared record, and business workspaces that attach documents to a vendor- Purpose
- Private storage for images attached to a shared subscription, and for contract documents attached to a business vendor.
- Data
- The images you attach, such as a receipt or payment screenshot, and a smaller preview copy; and the PDF documents a business attaches to a vendor, such as a contract.
- Where
- Placed automatically by Cloudflare; no regional restriction is set
Payments and bank connections
Stripe
Business workspaces and web purchases- Purpose
- Takes payment for business workspace plans and for Premium bought on the web.
- Data
- Billing name, email address, postal address and any tax ID entered at checkout, card details (which Stripe holds and we never see in full), and plan and invoice records.
- Where
- United States
Plaid
People who link a bank account or card, including Admins who link one to a workspace- Purpose
- Read-only bank connections, when someone chooses to link a bank account or card. Plaid connects banks in the United States and Canada.
- Data
- Account names, types and balances, and transaction history: merchant, amount and date. Bank credentials go to Plaid, never to us.
- Where
- United States
RevenueCat
Personal accounts that buy Premium in the mobile apps- Purpose
- Keeps a Premium plan bought in the iPhone, iPad or Android app in step with the account.
- Data
- Account ID, email address, and purchase and subscription status.
- Where
- United States
Email, text and push messages
Resend
All accounts and workspaces- Purpose
- Sends our other email, such as verification codes, password resets, reminders for personal accounts and account notices, and receives the email people forward to their Renew Reminder address. It also sends workspace email if our servers are not set up to use Mailbux, below.
- Data
- Email addresses, names and the content of each message, such as the subscription, amount and date in a reminder; forwarded emails.
- Where
- United States
Mailbux
People who contact support, and business workspaces- Purpose
- Hosts our support mailbox, support@renewreminder.com, and is our outgoing mail server for support replies and for workspace email: invitations, renewal notices (including those to people named in owner tags), escalations, monthly spend reports and billing notices.
- Data
- What you write to support, with your name and email address. For workspace email, the recipient's name and email address and the content of each message, such as a vendor's name, cost and renewal date.
- Where
- European Union (its mail servers are in Finland and France)
Twilio
People who turn on text reminders, including Business-plan workspace Admins- Purpose
- Sends text-message reminders and phone verification codes, including renewal alerts and escalations to the Admins of a workspace on the Business plan who turn them on.
- Data
- Phone number and the content of each message.
- Where
- United States
Google Firebase Cloud Messaging
People who use the mobile apps- Purpose
- Delivers push notifications to the mobile apps.
- Data
- Device push token and the text of each notification.
- Where
- United States
AI
OpenRouter
People who use Remi, statement import or email finds, including in a workspace- Purpose
- Routes requests from Remi, our AI assistant, and from reading receipts, statements and bills in email, to an AI model provider.
- Data
- The message, file or email being read, and the subscription details a request needs.
- Where
- United States
AI model providers, through OpenRouter
People who use Remi, statement import or email finds, including in a workspace- Purpose
- Generate Remi's replies and read documents and email. Our default models are Google's Gemini, served by Google; an OpenAI model is the fallback when Google is unavailable. Voice input is transcribed with OpenAI's Whisper model, and Remi's memory uses an OpenAI embedding model, each served by the provider OpenRouter routes the request to. Every request tells OpenRouter to use only providers that do not train on the data, and free models, which may, are never used.
- Data
- The same as OpenRouter, above.
- Where
- United States
Connected Google accounts
Google APIs
People who connect Gmail, Google Calendar or Google sign-in- Purpose
- Only when someone connects them: read-only Gmail access to find receipts and bills, adding renewals to Google Calendar, and signing in with Google.
- Data
- Emails read to find bills (we do not store the email itself), the renewal details added as calendar events, and the name and email address used to sign in.
- Where
- United States
Analytics, monitoring and consent
PostHog
All accounts and workspaces- Purpose
- Product analytics, so we can see which features are used and where people get stuck.
- Data
- Email address, used to identify the account, with usage events and device and browser details.
- Where
- United States
Sentry
All accounts and workspaces- Purpose
- Error monitoring and crash reports, so we can find and fix faults. Always on in the mobile apps; our servers and web app report errors to it when it is switched on for them.
- Data
- Error details, account ID and email address, and device or browser details. On the mobile apps, session recordings with text and images masked.
- Where
- United States
AppsFlyer
People who use the mobile apps- Purpose
- Measures which of our own ad campaigns bring people to the mobile apps.
- Data
- A device identifier, and install and subscription events.
- Where
- European Union and United States (on Amazon Web Services and Google Cloud)
Cookiebot
Visitors to the website and the web app- Purpose
- Asks for and records cookie consent on this website and in the web app.
- Data
- Your consent choices and a record of when they were made.
- Where
- European Union (Ireland, with fail-over to the Netherlands); its script is delivered through Akamai, a US network
When this list changes
We update this page before a new provider starts processing personal data for us. For business workspaces, we email the Admins of each workspace at least 30 days before a new sub-processor starts handling the workspace's data, as section 8 of the Data Processing Addendum describes, and the company can object. Anyone else who would like to be told about changes can ask us at support@renewreminder.com.