Plurity GmbH ("Plurity", "we") engages certain third-party service providers to help us deliver our products. Where these providers process personal data on our behalf, they act as sub-processors under our Data Processing Agreements (DPAs) with Customers, in accordance with Art. 28 GDPR.
This page lists the sub-processors we currently use, the purpose of each engagement, where the processing takes place, and the categories of data involved. All sub-processors are contractually bound to appropriate data protection obligations, including EU Standard Contractual Clauses (SCCs) where data is transferred outside the EEA.
| Sub-processor | Purpose | Location | Data processed |
|---|---|---|---|
| Cloudflare, Inc. | CDN, DNS, network security, and edge/proxy services | United States (EU-only processing via Cloudflare Regional Services) | IP address, request metadata, technical/traffic data |
| Fly.io, Inc. | Application hosting and compute infrastructure | United States (EU workloads hosted in Frankfurt, Germany) | Application data, account and usage data |
| Supabase, Inc. | Database, authentication, and backend infrastructure | United States (EU workloads hosted in Frankfurt, Germany) | Account data, authentication credentials, application data |
| OpenRouter, Inc. | LLM inference routing for AI analysis features | United States | Content submitted for AI analysis only — no personal data is transmitted |
| fal.ai (Features and Labels, Inc.) | AI inference for image and media generation | United States | Content submitted for AI processing only — no personal data is transmitted |
| Resend, Inc. | Transactional email delivery | European Union (EU region) | Name, email address, email content |
Where a sub-processor is located outside the European Economic Area (EEA), we ensure an appropriate transfer mechanism is in place, such as the European Commission's Standard Contractual Clauses (SCCs) or an equivalent adequacy safeguard, before any personal data is transferred.
We maintain this list on an ongoing basis. Customers with a signed Data Processing Agreement will receive at least 30 days' advance e-mail notice of any intended addition or replacement of a sub-processor, sent to the contact address they have designated. Customers may object on reasonable data protection grounds within that 30-day period; if no reasonable accommodation is found, the Customer may terminate the affected services.
For questions about this list or our data processing practices, see our Privacy Policy or contact us at privacy@plurity.ai.
We only use essential cookies required for this site to function — no tracking or advertising cookies. Learn more.