Sub-processors
Last updated: 19 October 2026
Sub-processors are the companies that process personal data on our behalf. This list covers all of them: those that handle the data we control as described in our privacy policy, and those that also process Customer Personal Data for our business customers under our data processing addendum.
1. Current sub-processors
| Sub-processor | What it does for baseray | Personal data it receives | Location and transfer safeguard |
|---|---|---|---|
| Microsoft Azure | Hosts the app, the API and our databases | Everything we store: accounts, workspaces, billing records, logs and Customer Personal Data | Poland Central region, EU. Data stays in the EU. |
| Cloudflare | DNS, network and HTTPS in front of baseray.tech, app.baseray.tech and api.baseray.ai; hosting of baseray.tech | Every request on its way to us, including IP addresses and what you send to the app and the API | Global network. EU-US Data Privacy Framework; Standard Contractual Clauses. |
| Resend | Sends account emails (email verification, password reset and workspace invitations) and the email with the link to a building report bought without an account | The recipient’s email address and the content of the email | USA. EU-US Data Privacy Framework; Standard Contractual Clauses. |
| Stripe (Stripe Payments Europe Ltd.) | Checkout, subscriptions, one-off building report payments, invoices, receipts and tax | What you enter at checkout (name, email, billing address, tax ID, card details), which goes to Stripe directly; your payment history | Ireland, EU. |
| PostHog (EU Cloud) | Product analytics and session recordings of every visit to baseray.tech and the app | Random visitor and session ids, pseudonymous user and workspace ids, page addresses with typed text removed, product events, AI-assistant tool calls without what the assistant typed or what we answered (the tool, outcome, duration, the assistant’s name and version, input names, and the answer’s size and how many buildings and businesses it holds), browser and device type, an approximate location derived from the IP address, and recordings of baseray.tech and the app as displayed (typed text masked); for signed-in people also their email address and name, their workspace’s name, and account and billing events; for people who bought a building report, the email address they gave at checkout and the purchase | Frankfurt, Germany, EU. Data stays in the EU. |
| Google (Google Maps Platform) | The map, the 3D view, address suggestions and address lookup in the app | Your IP address, the text you type into the address search and the map area you view, sent by your browser directly | USA. EU-US Data Privacy Framework; Standard Contractual Clauses. |
| Logodev, Inc. (logo.dev) | Shows your company’s logo in the app | Your company’s web domain, taken from the domain of the work email address you signed up with (we skip public email providers) | USA. Standard Contractual Clauses. |
| Google Ireland Limited (Google Ads) | Measures which of our ads bring visitors. Only while we advertise, and only for visitors who accept advertising cookies in our cookie banner | The pages visited on baseray.tech and the app, the ad clicked, the IP address, browser and device type, and the ids in Google’s advertising cookies | Ireland, EU; Google LLC, USA. EU-US Data Privacy Framework; Standard Contractual Clauses. |
Three of them also process Customer Personal Data for business customers: Microsoft Azure stores it, Cloudflare carries it between you and us, and Resend sends workspace invitations.
Stripe is also an independent controller for its own fraud prevention and regulatory compliance, under its own privacy policy. Google is also an independent controller for its own advertising purposes, under its own privacy policy.
2. Other recipients that are not our sub-processors
- Map tile servers. The app’s map shows the style you choose. Your browser loads that style’s images directly from its tile server, which receives your IP address and the area you are viewing and handles them under its own policy.
- AI assistants you connect. An assistant you connect through our MCP server, such as Claude or ChatGPT, receives the data you ask it to fetch. You choose it, and its provider’s terms and privacy policy apply.
- Authorities and advisers, where the law requires it, as our privacy policy describes.
The services we use to compile the building data, and to build and deploy our software, receive no personal data about our customers, so they are not on this list.
3. Changes to this list
We announce a new sub-processor of Customer Personal Data on this page at least 30 days before it starts. To receive these announcements by email, write to privacy@baseray.ai. Business customers can object as section 7 of the data processing addendum describes.