Legal
Sub-Processors
Last updated: 28 April 2026
DriftHR uses the following third-party service providers (“sub-processors”) to deliver the Service. Each is bound by contract to protect personal data handled on our behalf and to process it only on our documented instructions, consistent with our Privacy Policy and any Data Processing Addendum we have with you.
Infrastructure
| Sub-processor | Purpose | Data location | Data handled |
|---|---|---|---|
| Amazon Web Services, Inc. | Hosting (EC2), object storage (S3), transactional email (SES), DDoS protection (Shield) | Asia Pacific (Mumbai), ap-south-1 | All Service data including personal information |
| Cloudflare, Inc. | DNS, edge security (proxy + WAF + DDoS), Origin Certificate for the EC2 origin, Turnstile bot-protection on public forms | Global edge network | DNS lookups, IP address, user-agent, device characteristics at submission time |
Subscription billing (what you pay us)
| Sub-processor | Purpose | Data location | Data handled |
|---|---|---|---|
| Paddle.com Market Limited | Merchant of Record for DriftHR subscription payments outside India and New Zealand — checkout, taxes, card processing, invoices, dunning | UK / EU / US | Billing name and address, email, payment method (handled by Paddle; we receive only token + last-4), country of residence for tax |
| Razorpay Software Pvt Ltd | Subscription billing for India-based accounts — hosted authorization, mandates, recurring payments, invoices | India | Billing name, email, phone, payment method, country of residence for tax, subscription amount |
| Stripe Payments Europe Ltd / Stripe, Inc. | Subscription billing for New Zealand-based accounts — hosted checkout, recurring payments, invoices | EU / US | Billing name and address, email, payment method, country of residence for tax, subscription amount |
End-customer payments (what your buyers pay you, e-commerce only)
These providers handle money flowing directly from your end customers to you. Loominfo never holds end-customer funds. You connect a provider in your shop settings and the provider settles funds to your bank.
| Sub-processor | Purpose | Data location | Data handled |
|---|---|---|---|
| Razorpay Software Pvt Ltd | Razorpay Route — payment splits and seller settlements for India-based shops | India | Buyer name, email, phone, payment method, transaction amount, shipping address (passed to seller) |
| Stripe Payments Europe Ltd / Stripe, Inc. | Stripe Connect — payment splits and seller settlements for global shops outside India | EU / US | Buyer name, email, phone, payment method, transaction amount, shipping address (passed to seller) |
Communications
| Sub-processor | Purpose | Data location | Data handled |
|---|---|---|---|
| Amazon SES (AWS, Inc.) | Transactional email delivery (signup OTP, booking confirmations, order receipts, password reset, etc.) | Asia Pacific (Mumbai) | Recipient email, subject, body content (which may include name, booking, or order details) |
| MSG91 Communications Pvt Ltd | SMS delivery for India-based recipients (DLT-compliant) | India | Recipient phone, message content (OTPs, booking reminders, order updates) |
| Twilio Inc. | SMS delivery for non-India recipients (global) | Global (US-headquartered) | Recipient phone, message content |
Optional integrations
These run only when the relevant feature is enabled by the Business or chosen by the end Customer.
| Sub-processor | Purpose | Data location | Data handled |
|---|---|---|---|
| Google LLC — Google Sign-In | Optional social login for end customers | Global | Email, name, Google user ID — only when the user chooses Google sign-in |
| Google LLC — Calendar / Meet | Optional video-meeting integration for appointment bookings | Global | Calendar events, meeting URLs — only when the Business connects Google Workspace |
| Zoom Video Communications, Inc. | Optional video-meeting integration for appointment bookings | US | Meeting metadata — only when the Business connects Zoom |
| Microsoft Corporation — Teams | Optional video-meeting integration for appointment bookings | Global | Meeting metadata — only when the Business connects Microsoft 365 |
Operational tooling
| Sub-processor | Purpose | Data location | Data handled |
|---|---|---|---|
| Functional Software, Inc. (Sentry) | Server-side error tracking | EU (Frankfurt) | Stack traces, request URLs, IP, user-agent. We scrub email and request bodies before send. |
| PostHog Inc. | Product analytics (only with consent), session replay (only with consent) | US | Page views, click events, anonymous user ID. PII is masked in session replay. |
Changes to this list
We will update this page within 30 days of adding, removing, or changing a sub-processor. Business customers who wish to be notified by email when this list changes can subscribe at [email protected].
Objections
If you have a reasonable objection to a specific sub-processor we use, contact us at [email protected] within 30 days of this page being updated, and we will work with you in good faith to find a resolution.
This page is referenced from our Terms of Service and Privacy Policy.