Subprocessors

Version 1.5 · Effective: Sep 16, 2026 · Last updated: Sep 16, 2026

1. What this list is

A subprocessor is a third-party provider that processes Service data on our behalf to run RUMA. This page is the canonical, always-current list. Active providers process data only to provide their stated functions under applicable contractual terms. A provider or function explicitly marked announced or pending is listed in advance and is not yet processing public visitor Service data for that feature. If its row separately discloses controlled, access-restricted staging verification, only synthetic test prompts may be used before public activation. A former provider receives no new Service data and remains listed while its contractual deletion or retention period is being verified. Before public processing begins, RUMA must complete its contract and data-protection review and impose the obligations required by our Data Processing Addendum. We do not sell personal information.

2. Current subprocessors

Provider	Function	Location	Data involved	Status / added
Cloudflare, Inc.	Hosting, edge/API processing, database and object storage, Turnstile abuse prevention, operational counters, AI Gateway, and Workers AI inference for the optional RUMA Assistant on public marketing pages	USA / global edge and inference network	Service data in transit and at rest; uploaded files; transient IP address and Turnstile signals; content-free Assistant operational counters. When a visitor chooses Start chat, Cloudflare Worker, AI Gateway, and Workers AI will process the current visitor message and, for at most five eligible earlier turns, only a server-owned trusted plan/topic marker and the corresponding deterministic RUMA answer. Prior raw visitor messages are never replayed to Workers AI. Cloudflare also receives a keyed, per-session pseudonymous safety identifier for abuse monitoring; it contains no raw IP address, raw Assistant session identifier, or RUMA account identifier. Each Assistant turn or D1 handoff row is excluded from active reads when it reaches 90 days and is physically deleted at the next successful daily purge, normally within 24 hours; backup copies age out on a separate rolling cycle and are not restored into active service after expiry. For visitor conversations, AI Gateway log-entry collection must remain disabled, including request and response bodies and per-request metadata; the server also applies request-level collection controls. RUMA retains limited usage and safety records in its own service database. Workers diagnostic logging and other storage are governed separately, as described in the Privacy Notice. This RUMA list names direct providers and incorporates Cloudflare's current downstream subprocessor list by reference through Cloudflare's published list	Provider added July 8, 2026; Workers AI announced September 3, 2026; optional Assistant processing described September 16, 2026
Resend, Inc.	Transactional email (invitations, reminders, security emails)	USA	Recipient name and email address; the content of Service emails	July 8, 2026
Stripe, Inc.	Subscription payment processing (card details collected by Stripe directly)	USA	Billing contact; plan, subscription status and invoices; card metadata (brand, last4, expiry)	July 10, 2026
PostHog, Inc.	Product analytics (pseudonymized usage events) — announced ahead of activation; not yet processing Service data	USA	Once active: pseudonymized usage events only (coarse event names and properties, keyed-hash pseudonyms) — never names, emails, addresses, message or document content, uploaded files, or raw account identifiers	Announced July 28, 2026 — pending activation
Anthropic, PBC	Former RUMA Assistant API provider — retired; no new Assistant requests	USA / global processing (data stored in USA)	No new Assistant messages are sent to Anthropic. Anthropic remains listed during offboarding until RUMA verifies completion of any contractual deletion or retention period that applies to historical Assistant API data	Former provider — deletion/retention verification pending

3. Changes & objections

We update this page before a new subprocessor starts processing Service data, and we notify business Customers of the change by in-app or email notice. If a Customer has a reasonable data-protection objection to a new subprocessor, contact privacy@ruma.rent within 30 days of the notice — we will work with you in good faith on a solution, and if none is possible you may terminate the affected Subscription as described in the Data Processing Addendum.

4. Contact

Questions about this list: privacy@ruma.rent. Operator: StatGazer LLC, a New York limited liability company, 418 Broadway, STE R, Albany, NY 12207, USA.