Subprocessors

Version 2026-11. Last updated October 30, 2026.

These companies process customer data for Open & Run so we can provide the service. Each one is bound by a written agreement that limits how it can use the data. We update this page at least 30 days before adding or replacing a subprocessor that handles customer data, and we email each company's billing owner when we do.

Customer data

Company	What they do for us	Data involved	Location
Supabase	Database, sign-in and file storage	All customer data, including reports, medical details and uploaded files	United States (US East)
Vercel	Hosts and runs the app	Customer data passing through requests; app logs	United States (US East)
Resend	Sends app emails	Recipient names and email addresses; email content (for example report notifications)	United States
Stripe	Payments and billing	Billing contact, payment details (card numbers stay with Stripe), subscription status	United States
Google Cloud (Document AI)	Reads uploaded invoices	Invoice files	United States
Google Maps Platform (Places)	Address search when adding a location or billing address	Address text being typed	United States
Upstash	Rate limiting to block abuse	IP addresses, user IDs and email addresses, kept briefly	United States (US East)

Website tools (not customer data)

These run only on our public pages, never inside the app once someone has finished signing up.

Company	What it does	Data involved
Google (sign-in)	"Continue with Google"	Name, email, profile picture and Google account ID of the person signing in
Google Analytics	Website and signup analytics	Page views and device data on public pages; signup, checkout and subscription events with the plan amount (no names or emails)
Meta	Ad measurement	Page views on public pages; signup and subscription events (hashed email, browser type, ad click ID) for businesses that haven't opted out
Web3Forms	Website contact form	Name, email address and message sent through the contact form

Questions: admin@openandrun.com