Sub-processors
Last updated: 14 October 2026
Sub-processors are the companies that process personal data on our behalf. This list covers all of them: those that handle the data we control as described in our privacy policy, and those that also process Customer Personal Data for our business customers under our data processing addendum.
1. Current sub-processors
| Sub-processor | What it does for baseray | Personal data it receives | Location and transfer safeguard |
|---|---|---|---|
| Microsoft Azure | Hosts the app, the API and our databases | Everything we store: accounts, workspaces, billing records, logs and Customer Personal Data | Poland Central region, EU. Data stays in the EU. |
| Cloudflare | DNS, network and HTTPS in front of baseray.ai, app.baseray.ai and api.baseray.ai; hosting of baseray.ai | Every request on its way to us, including IP addresses and what you send to the app and the API | Global network. EU-US Data Privacy Framework; Standard Contractual Clauses. |
| Resend | Sends account emails: email verification, password reset and workspace invitations | The recipient’s email address and the content of the email | USA. EU-US Data Privacy Framework; Standard Contractual Clauses. |
| Stripe (Stripe Payments Europe Ltd.) | Checkout, subscriptions, invoices and tax | What you enter at checkout (name, email, billing address, tax ID, card details), which goes to Stripe directly; your payment history | Ireland, EU. |
| PostHog (EU Cloud) | Product analytics | A pseudonymous user id, page addresses (in the app these can include the map position and the text of a search), product events, browser and device type, and an approximate location derived from the IP address | Frankfurt, Germany, EU. Data stays in the EU. |
| Google (Google Maps Platform) | The map, the 3D view, address suggestions and address lookup in the app | Your IP address, the text you type into the address search and the map area you view, sent by your browser directly | USA. EU-US Data Privacy Framework; Standard Contractual Clauses. |
| Logodev, Inc. (logo.dev) | Shows your company’s logo in the app | Your company’s web domain, taken from the domain of the work email address you signed up with (we skip public email providers) | USA. Standard Contractual Clauses. |
Three of them also process Customer Personal Data for business customers: Microsoft Azure stores it, Cloudflare carries it between you and us, and Resend sends workspace invitations.
Stripe is also an independent controller for its own fraud prevention and regulatory compliance, under its own privacy policy.
2. Other recipients that are not our sub-processors
- Map tile servers. The app’s map shows the style you choose. Your browser loads that style’s images directly from its tile server, which receives your IP address and the area you are viewing and handles them under its own policy.
- AI assistants you connect. An assistant you connect through our MCP server, such as Claude or ChatGPT, receives the data you ask it to fetch. You choose it, and its provider’s terms and privacy policy apply.
- Authorities and advisers, where the law requires it, as our privacy policy describes.
The services we use to compile the building data, and to build and deploy our software, receive no personal data about our customers, so they are not on this list.
3. Changes to this list
We announce a new sub-processor of Customer Personal Data on this page at least 30 days before it starts. To receive these announcements by email, write to [email protected]. Business customers can object as section 7 of the data processing addendum describes.