Subprocessors
The providers that process personal data so Outbox can work, what they do and where.
Last updated:
Current list
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, CDN, compute (Workers), storage (R2, KV, D1, Durable Objects), bot protection (Turnstile), cookieless web analytics | All account data and content | U.S. and global network |
| Lemon Squeezy, LLC (Stripe) | Merchant of record: payments, taxes, receipts, subscription portal | Name, email, payment data, country, plan | U.S. |
| Resend (Plus Five Five, Inc.) | Transactional email and notifications | Email, username, email content | U.S. |
| Google LLC | Sign in with Google (only if you use it) | Email, name, Google identifier, photo | U.S. |
| GitHub, Inc. | Sign in with GitHub (only if you use it) | Email, GitHub username and identifier, avatar | U.S. |
Fonts are served from Google Fonts and footer badges from shields.io; those services receive your IP when the page loads, but no account data.
Change notices
Before adding a new subprocessor we update this page at least 30 days in advance. Customers with a DPA can ask for email notice and object by writing to hello@out-box.dev.