Subprocessors
Last updated
September 13, 2026
The third parties we rely on to run Rybbit, what each one does, and where it processes data.
Rybbit uses a small number of third-party service providers ("subprocessors") to deliver the Rybbit cloud service. Each subprocessor processes personal data only to the extent needed to provide its service to us, under a written agreement that imposes data protection obligations at least as protective as those in our Data Processing Agreement.
This page lists every subprocessor that may process customer personal data. If you self-host Rybbit, none of these providers receive your data.
Infrastructure
These providers host and serve the Rybbit application and the analytics data collected on your behalf.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Hetzner Hetzner Online GmbH | Cloud infrastructure: application servers, databases, and backups that run the Rybbit service. | All customer account data and analytics data collected on your behalf. | Germany and Finland (EU) |
| Cloudflare Cloudflare, Inc. | Content delivery network, DNS, DDoS protection, and object storage. | Network traffic metadata (IP addresses in transit, request headers) and stored objects such as session replay recordings. | United States (global edge network) |
Billing, email, and support
These providers process account holder data, not the analytics data collected from your visitors.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Stripe Stripe, Inc. | Payment processing, subscription billing, and invoicing. | Billing name, email address, billing address, and payment details. Rybbit never stores card numbers. | United States |
| Resend Resend, Inc. | Transactional and product email delivery (account, billing, alerts, and reports). | Email address, name, and the contents of the emails we send you. | United States |
| Google Workspace (Gmail) Google LLC | Business email for support and customer correspondence. | Name, email address, and the contents of messages you send to us. | United States |
AI features
These providers are only used when you use an AI-assisted feature. Data sent to them is limited to the request you make and the analytics data needed to answer it. Our agreements with these providers prohibit using your data to train their models.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Anthropic Anthropic, PBC | Large language model provider for AI-assisted features. | Content you submit to AI features and the analytics data those features summarize. Not used to train models. | United States |
| OpenAI OpenAI, L.L.C. | Large language model provider for AI-assisted features. | Content you submit to AI features and the analytics data those features summarize. Not used to train models. | United States |
International transfers
Analytics data is stored on Hetzner servers in the European Union. Where a subprocessor processes personal data outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses or, where applicable, the EU-U.S. Data Privacy Framework.
Changes to this list
We will update this page before adding or replacing a subprocessor. Customers with a signed Data Processing Agreement will be notified by email at least 30 days in advance and may object to the change as described in the DPA. To receive notifications, email hello@rybbit.comwith the subject line "Subprocessor notifications".
Change log
- September 13, 2026: Published this page. Added Google Workspace (Gmail), Anthropic, and OpenAI to the list previously maintained in the DPA.
Contact
Questions about our subprocessors or data handling? Email us at hello@rybbit.com.