Legal
Subprocessors
Third-party subprocessors and service providers used to deliver Reshot.
Effective: May 10, 2026
Summary
This page is the source of truth for third-party providers that materially help us operate Reshot. It is incorporated into our Privacy Policy and Data Processing Agreement.
We give at least 30 days’ notice before authorizing a new subprocessor to process Customer Personal Data, except where urgent replacement is needed for security, availability, legal compliance, or service continuity. Customers may object on reasonable data protection grounds within 14 days after notice.
Active subprocessors
| Provider | Purpose | Data categories | Processing location |
|---|---|---|---|
| Vercel Inc. | Application hosting, edge functions, web delivery | Request metadata, application data, access logs, limited Customer Content routed through hosted services | United States and global edge |
| Supabase Inc. | Database, authentication, object storage, export storage | Account data, workspace data, Customer Content, screenshots, metadata, hashed or protected tokens | United States |
| Cloudflare Inc. | DNS, CDN, DDoS protection, bot management, asset delivery | IP addresses, request headers, access logs, published asset delivery metadata | Global edge |
| Upstash Inc. | Redis cache, rate limiting, queue or workflow state | Pseudonymous request identifiers, counters, temporary operational metadata | United States |
| Resend Inc. | Transactional email delivery | Email address, name, workspace metadata, transactional email content | United States |
| Functional Software, Inc. (Sentry) | Error monitoring, performance diagnostics | Error events, stack traces, device/browser metadata, IP address or truncated IP where configured | United States or configured region |
| PostHog Inc. | Product analytics for Reshot application usage | Pseudonymous usage events, page and feature events, browser/device metadata | United States |
| Channel Corp. (Channel.io) | Customer support chat and support history | Name, email, chat messages, support metadata, browser/device metadata | Republic of Korea |
Independent controllers and payment providers
| Provider | Role | Purpose | Notes |
|---|---|---|---|
| Paddle.com Market Limited or applicable Paddle entity | Independent controller / merchant of record | Checkout, payments, invoicing, taxes, refunds, chargebacks | Paddle processes payment data under its own buyer terms and privacy notice. We receive limited transaction metadata and do not store complete card or bank details. |
Customer-selected integrations and destinations
The following are not automatically Reshot subprocessors. They process data only when you choose to connect or configure them, and their own terms and privacy notices may apply.
| Provider or category | Purpose | Treatment |
|---|---|---|
| GitHub or other version-control providers | Repository metadata, CI/CD workflows, release or documentation workflows | Customer-selected integration; data is sent or received according to scopes and permissions you configure |
| Slack or other notification providers | Notifications, approval alerts, workflow updates | Customer-selected destination; you control the workspace/channel/webhook |
| Customer webhooks | Delivery of events to URLs you configure | Customer-selected destination; you are responsible for the receiving endpoint |
| Bring-your-own-storage providers | Customer-controlled screenshot or asset storage | Customer-controlled infrastructure; not our subprocessor when data is stored under your account and instructions |
| Documentation platforms | Embedding or publishing screenshots in your documentation | Customer-selected destination; public or private access depends on your configuration |
Subprocessor commitments
For subprocessors that process Customer Personal Data under our DPA, we require written commitments imposing data protection obligations no less protective than those in our DPA. We remain responsible for their processing as required by the DPA.
Change notices
We will update this page when we add, replace, or materially change a subprocessor. To request email notice of subprocessor changes, contact privacy@reshot.dev.
Change log
| Date | Change |
|---|---|
| May 10, 2026 | Rebuilt Reshot subprocessor list as a standalone source of truth. |
Contact
Subprocessor and DPA questions: privacy@reshot.dev