Subprocessor list
This is an English translation of a document drawn up in Polish and governed by Polish law. It is provided for information only: if the two versions differ, the Polish version prevails.
Contents
Version 1.3 · in force from: 22 October 2026 · last updated: 2026-10-22
A list of the providers we entrust with processing data in connection with providing the OneRental service. It forms Annex B to the Data Processing Agreement and is part of the Privacy Policy.
How we notify you of changes: we inform customers about the addition or change of a subprocessor by e-mail and by updating this page, at least 30 days in advance. During that time you may raise a reasoned objection – the procedure is described in § 5 of the Data Processing Agreement. To receive notifications, write to privacy@onerental.app.
1. Infrastructure and data storage
| Provider | Role in the service | Processing location | Basis for transfer outside the EEA |
|---|---|---|---|
| Vercel Inc. (USA) | application hosting, content delivery network, server functions, file storage (Blob), logs, feature flags | EU – Frankfurt (fra1) + USA | SCC / DPF |
| Neon Inc. (USA) | Postgres database holding production data | EU – Frankfurt (eu-central-1) | SCC / DPF |
| Upstash, Inc. (USA) | cache, rate limits (Redis) | EU – Frankfurt (eu-central-1) | SCC |
| Cloudflare, Inc. (USA) | anti-bot protection for forms (Turnstile), network layer | global, with EU priority | SCC / DPF |
2. Payments and billing
| Provider | Role in the service | Location | Transfer basis |
|---|---|---|---|
| Stripe Payments Europe, Ltd. (Ireland) | handling subscription payments, invoices, customer portal | EU + USA (Stripe, Inc.) | SCC / DPF |
3. Communication with users
| Provider | Role in the service | Location | Transfer basis |
|---|---|---|---|
| Resend (USA) | sending transactional messages (confirmations, notifications) | EU – Ireland (account region eu-west-1) | SCC |
| Knock Labs, Inc. (USA) | orchestration of in-app and e-mail notifications | USA | SCC |
| Cal.com, Inc. (USA) | booking demo calls in the calendar on the Book a demo page and the industry pages (name, e-mail, optional notes, chosen time), booking confirmations and reminders, the call itself in Cal Video | USA (Amazon Web Services) | SCC / DPF |
Cal.com processes only the data of people who book a demo call with us, never the data that rental companies keep in OneRental. The calendar loads from app.cal.com, so Cal.com also receives the IP address and browser details of everyone who opens the Book a demo page or scrolls an industry page down to the calendar. Cal.com stores the data in the United States and uses its own subprocessors, among them Postmark for booking e-mails and Daily.co for Cal Video calls. Their list: trust.cal.com/subprocessors.
4. Analytics and monitoring
| Provider | Role in the service | Location | Transfer basis |
|---|---|---|---|
| Google Ireland Ltd. | Google Tag Manager, Google Analytics and Google Ads (conversion measurement, enhanced conversions with hashed e-mail and phone, remarketing) on the marketing pages and in the sign-up flow – with consent to cookies; before consent, only cookieless Consent Mode signals (§ 5.4 of the Privacy Policy) | EU + USA | SCC / DPF |
| Meta Platforms Ireland Ltd. | measurement of advertising campaign conversions (only with consent) | EU + USA | SCC / DPF |
| Vercel Inc. (USA) | Vercel Analytics and Speed Insights – visit and performance statistics, without cookies | EU – Frankfurt (fra1) + USA | SCC / DPF |
| Umami | visit statistics for the marketing pages – self-hosted instance, on our infrastructure | EU – Frankfurt | – |
| Better Stack, Inc. (USA) | application logs and server telemetry, error reports on the server and browser side; with consent to analytics, also real user monitoring: sessions, session recordings, performance metrics and interface events | EU – Germany (the source data region) | SCC / DPF |
Application logs, telemetry and error reports go to Better Stack – we created the data source in the Germany region, and standard log retention is 30 days. In parallel, logs remain available in Vercel's infrastructure (30-day retention).
We run the Better Stack script in the browser (session recordings, performance metrics, interface events) only after consent to analytics cookies has been given – until then it is not downloaded at all and nothing reaches Better Stack from your device. To logged-in users we assign the account identifier, the first and last name and the e-mail address, and – in a company's panel – the company's identifier, name and plan. The details are described in the Cookie Policy.
5. Authentication
| Provider | Role in the service | Location | Transfer basis |
|---|---|---|---|
| Google Ireland Ltd. | signing in with a Google account (OAuth / One Tap) | EU + USA | SCC / DPF |
6. Internal tools
Slack (team notifications about technical events) and GitHub (code repository, issues) do not process renter data in normal operation; they may incidentally contain data within the body of a service request. We apply the rule of not placing personal data in them.
Change history
| Date | Change |
|---|---|
| 2026-08-01 | First publication of the list |
| 2026-09-14 | Removal of OpenAI and the Vercel AI gateway – the Application does not use AI models |
| 2026-10-11 | Google: Google Ads conversion measurement, enhanced conversions and remarketing added to the description |
| 2026-10-19 | Cal.com added: booking demo calls on the Book a demo page |
| 2026-10-22 | Cal.com: the demo booking calendar also at the bottom of the industry pages |