Sub-processors
Last updated: 28 September 2026
These are the service providers Rentoutbase uses to deliver the service. They may process personal data on behalf of our customers, and this list forms part of our data processing agreement.
| Provider | Purpose | Personal data | Location |
|---|---|---|---|
| Supabase | Database, sign-in and file storage (photos and documents). | All data stored in the service: account details, properties, tenants, contracts, rent records, messages, damage reports and photos, uploaded documents and sign-in details. | EU: AWS region eu-west-1, Ireland. |
| Vercel | Hosting of the website, dashboard and API, and page-view statistics (Vercel Web Analytics). | Data passing through the service while a request is handled, technical details such as IP addresses, and page-view statistics. | Server functions run in Dublin, Ireland (EU). Content is delivered through Vercel’s global edge network. Vercel is a US company. |
| OpenAI (API) | AI processing: conversations with Rob AI, maintenance triage, drafts of replies to tenants, and contract and listing import. | The landlord’s request and the portfolio data relevant to it, such as properties, tenancies, rent status and tenant messages; text and photos from damage reports; the text of contracts and listings being imported. | OpenAI is a US company. Processing takes place outside the EEA, including in the US. OpenAI does not use data sent through its API to train its models. |
| Resend | Email from the service: access codes, contract links, notifications and reminders, and enquiries from the contact and demo forms. | The recipient’s name and email address, and the content of the email. | Resend is a US company. Processing may take place in the US. |
| Stripe | Subscription billing. Rent collection through Stripe is used only where that feature has been enabled for the account. | The customer’s name, email, subscription and payment details. For rent collection, also the tenant’s name and email and the rent amount. | Stripe is a US company. Processing may take place in the US. |
| Apple | Push notifications to the iOS app (Apple Push Notification service). | The device’s push token and the notification’s title and text, which may include a short excerpt of a message. | Apple is a US company. Processing may take place outside the EEA. |
| Expo | Delivery of push notifications to the tenant app, and the tooling the app is built with. | The device’s push token and the notification’s title and text, which may include a short excerpt of a message. | Expo is a US company. Processing may take place outside the EEA. |
Transfers outside the EEA
The service’s database and file storage are in the EU (Ireland), and its server functions run in Ireland. Several providers are US companies or may process personal data outside the EEA, as the table shows. Such transfers take place under each provider’s data processing terms. Contact us if you would like to know more.
AI processing
Personal data is sent to OpenAI only when a customer uses an AI feature or has switched on Rob AI, and only what is relevant to the request. A message Rob has drafted is sent to a tenant only once the customer has approved the exact text.
Changes to this list
Before a new or replacement sub-processor starts processing personal data on a customer’s behalf, we update this list and notify customers by email at least 30 days in advance. Customers can object, as described in section 8 of the data processing agreement.
Contact
Questions about our sub-processors: support@rentoutbase.com