Subprocessor list
This is an English translation of a document drawn up in Polish and governed by Polish law. It is provided for information only: if the two versions differ, the Polish version prevails.
Contents
Version 1.1 · in force from: 11 October 2026 · last updated: 2026-10-11
A list of the providers we entrust with processing data in connection with providing the OneRental service. It forms Annex B to the Data Processing Agreement and is part of the Privacy Policy.
How we notify you of changes: we inform customers about the addition or change of a subprocessor by e-mail and by updating this page, at least 30 days in advance. During that time you may raise a reasoned objection – the procedure is described in § 5 of the Data Processing Agreement. To receive notifications, write to privacy@onerental.app.
1. Infrastructure and data storage
| Provider | Role in the service | Processing location | Basis for transfer outside the EEA |
|---|---|---|---|
| Vercel Inc. (USA) | application hosting, content delivery network, server functions, file storage (Blob), logs, feature flags | EU – Frankfurt (fra1) + USA | SCC / DPF |
| Neon Inc. (USA) | Postgres database holding production data | EU – Frankfurt (eu-central-1) | SCC / DPF |
| Upstash, Inc. (USA) | cache, rate limits (Redis) | EU – Frankfurt (eu-central-1) | SCC |
| Cloudflare, Inc. (USA) | anti-bot protection for forms (Turnstile), network layer | global, with EU priority | SCC / DPF |
2. Payments and billing
| Provider | Role in the service | Location | Transfer basis |
|---|---|---|---|
| Stripe Payments Europe, Ltd. (Ireland) | handling subscription payments, invoices, customer portal | EU + USA (Stripe, Inc.) | SCC / DPF |
3. Communication with users
| Provider | Role in the service | Location | Transfer basis |
|---|---|---|---|
| Resend (USA) | sending transactional messages (confirmations, notifications) | EU – Ireland (account region eu-west-1) | SCC |
| Knock Labs, Inc. (USA) | orchestration of in-app and e-mail notifications | USA | SCC |
4. Analytics and monitoring
| Provider | Role in the service | Location | Transfer basis |
|---|---|---|---|
| Google Ireland Ltd. | Google Tag Manager, Google Analytics and Google Ads (conversion measurement, enhanced conversions with hashed e-mail and phone, remarketing) on the marketing pages and in the sign-up flow – with consent to cookies; before consent, only cookieless Consent Mode signals (§ 5.4 of the Privacy Policy) | EU + USA | SCC / DPF |
| Meta Platforms Ireland Ltd. | measurement of advertising campaign conversions (only with consent) | EU + USA | SCC / DPF |
| Vercel Inc. (USA) | Vercel Analytics and Speed Insights – visit and performance statistics, without cookies | EU – Frankfurt (fra1) + USA | SCC / DPF |
| Umami | visit statistics for the marketing pages – self-hosted instance, on our infrastructure | EU – Frankfurt | – |
| Better Stack, Inc. (USA) | application logs and server telemetry, error reports on the server and browser side; with consent to analytics, also real user monitoring: sessions, session recordings, performance metrics and interface events | EU – Germany (the source data region) | SCC / DPF |
Application logs, telemetry and error reports go to Better Stack – we created the data source in the Germany region, and standard log retention is 30 days. In parallel, logs remain available in Vercel's infrastructure (30-day retention).
We run the Better Stack script in the browser (session recordings, performance metrics, interface events) only after consent to analytics cookies has been given – until then it is not downloaded at all and nothing reaches Better Stack from your device. To logged-in users we assign the account identifier, the first and last name and the e-mail address, and – in a company's panel – the company's identifier, name and plan. The details are described in the Cookie Policy.
5. Authentication
| Provider | Role in the service | Location | Transfer basis |
|---|---|---|---|
| Google Ireland Ltd. | signing in with a Google account (OAuth / One Tap) | EU + USA | SCC / DPF |
6. Internal tools
Slack (team notifications about technical events) and GitHub (code repository, issues) do not process renter data in normal operation; they may incidentally contain data within the body of a service request. We apply the rule of not placing personal data in them.
Change history
| Date | Change |
|---|---|
| 2026-08-01 | First publication of the list |
| 2026-09-14 | Removal of OpenAI and the Vercel AI gateway – the Application does not use AI models |
| 2026-10-11 | Google: Google Ads conversion measurement, enhanced conversions and remarketing added to the description |