This page lists every third party that processes personal data on behalf of Renmy UG (haftungsbeschränkt) i.G., Apoldaer Str. 21, 12249 Berlin, Germany, not yet entered in the commercial register of the Amtsgericht Charlottenburg and represented by its managing directors René Knierim and Mandy Bebenroth, for renmy runtime and this website. Per Art. 28 GDPR and our data processing agreement, these subprocessors are bound by contractual obligations equivalent to those between us and you.
Notification of changes: we will update this page at least 30 days before any new subprocessor begins processing personal data, except where prior notice is not legally possible. To receive notifications by email, contact privacy@renmy.net.
Current subprocessors
Supabase Inc.
- Role
- Authentication, database, edge functions, file storage
- Data processed
- Email address, hashed password / OAuth identifier, account metadata, subscription state, team memberships, consent records, license keys (encrypted at rest); signups for release updates, with the browser's user agent and the referring page; enquiries sent through the consulting and team enquiry forms
- Location
- European Union (West EU, Ireland)
- Transfer mechanism
- EU-based, no transfer outside EEA
Stripe Payments Europe, Ltd.
- Role
- Payment processing, subscription billing, tax calculation, invoicing
- Data processed
- Email address, billing address, card last 4 digits, VAT ID (B2B), country, transaction history, invoices
- Location
- Ireland (EU). Some processing may occur in the United States via Stripe Inc.
- Transfer mechanism
- EU Standard Contractual Clauses (SCCs) for any US transfer; Stripe is GDPR-compliant.
Keygen, Inc.
- Role
- Software license issuance and validation, machine activation tracking
- Data processed
- Email address (license name), Supabase user ID (metadata), machine fingerprint, hostname, machine display name, OS and architecture, CPU core count, CI provider or agent name, last validation time
- Location
- United States
- Transfer mechanism
- EU Standard Contractual Clauses (SCCs).
Fly.io, Inc.
- Role
- Static website hosting (renmy.net)
- Data processed
- IP address, user agent, request logs (no application data: Fly hosts only static files)
- Location
- Frankfurt (fra, primary), London (lhr), Ashburn (iad), San José (sjc) and Sydney (syd); each request is served from the region nearest the visitor
- Transfer mechanism
- EU-U.S. Data Privacy Framework with its UK Extension (Fly.io is certified; Art. 45 GDPR); London: UK adequacy decision.
Sentry (Functional Software EMEA Ltd.)
- Role
- Frontend and edge function error monitoring
- Data processed
- Stack traces, error codes, page URL, browser metadata (user agent, OS), anonymized IP. No email addresses, user identifiers, or request bodies.
- Location
- European Union (Frankfurt). Parent company Functional Software, Inc. has US presence; incidental US access by support staff possible.
- Transfer mechanism
- EU data residency active. EU Standard Contractual Clauses (SCCs) for any incidental US access.
Resend, Inc.
- Role
- Delivery of optional renmy runtime product-update emails, and of the emails the service sends on its own: team invitations, and team and consulting enquiry notifications
- Data processed
- Email address, email content (for enquiry notifications, the enquiry's contents), delivery status, and unsubscribe headers; product updates only for users who explicitly opt in
- Location
- United States
- Transfer mechanism
- EU Standard Contractual Clauses (SCCs).
STRATO GmbH
- Role
- Email hosting for the renmy.net mailboxes (support, sales, security, consulting, privacy), and DNS for renmy.net and renmy.de
- Data processed
- Emails sent to and from renmy.net addresses, with their contents, attachments, sender and recipient addresses, and the connection data of each delivery
- Location
- Germany
- Transfer mechanism
- EU-based, no transfer outside EEA
Cloudflare, Inc.
- Role
- Documentation search and chat on renmy.net (Cloudflare AI Search), and the reverse proxy in front of testnimbus.dev, the former domain, which redirects to renmy.net and still serves the install scripts
- Data processed
- Search queries and chat messages; IP address, browser information and request data of each request to the search, the chat and testnimbus.dev. The search is set to send no usage statistics.
- Location
- United States and other countries where Cloudflare operates
- Transfer mechanism
- EU Standard Contractual Clauses (SCCs).
Standalone services (no personal data processed)
The following service is used by us but does not process customer personal data: GitHub (source hosting). It is listed for transparency but is not a GDPR Art. 28 subprocessor.
Questions or concerns
For questions about our data processing, to request a signed data processing agreement, or to object to a subprocessor, contact privacy@renmy.net. See also our data processing agreement and privacy policy.