Sub-processors
Last updated: 20 October 2026
RotaHero uses the following providers (sub-processors) to deliver the service. Each one processes personal data only as needed for its purpose, under a data processing agreement with us.
Current sub-processors
| Sub-processor | Purpose | Data involved | Location | Transfer safeguards |
|---|---|---|---|---|
| Cloudflare, Inc. | Hosting, application runtime, database, backups, the records archive, protection against abuse, and server logs | All service data. Server logs and abuse protection: IP addresses, account references, email addresses entered at sign-in or for a reset, and technical request details | Database, backups and the records archive are stored at rest in the European Union (Cloudflare's EU data jurisdiction). Requests are handled at the nearest Cloudflare location; abuse protection, server logs (kept 7 days) and temporary processing copies may be handled elsewhere on its global network, including in the United States | Cloudflare Customer DPA: Standard Contractual Clauses with the UK International Data Transfer Addendum |
| Plus Five Five, Inc. (Resend) | Sending email: account and sign-in emails, security alerts, invitations, and the rota and request emails an employer turns on for its staff; delivering in-app feedback to our support mailbox | Recipient email addresses and the email content, such as staff names, shift dates and times, and request outcomes; for feedback, the sender's email address and message | United States | Resend DPA: Standard Contractual Clauses with the UK International Data Transfer Addendum |
| Functional Software, Inc. (Sentry) | Error monitoring for the apps and our server | Technical error reports, which can incidentally contain fragments of what was on screen; configured to exclude IP addresses | European Union (Germany) | Stored in the EU. Sentry DPA for any access from the United States: the UK Extension to the EU-US Data Privacy Framework, otherwise Standard Contractual Clauses with the UK International Data Transfer Addendum |
| Google Cloud EMEA Limited (Google Workspace) | Our business email, which receives support requests, data-protection requests, complaints and in-app feedback | Whatever customers and their staff write to us, which can include staff details | Stored in Europe; Google may process it, and give support for it, from outside Europe | Google Cloud Data Processing Addendum: the UK Extension to the EU-US Data Privacy Framework, otherwise Standard Contractual Clauses |
Changes to this list
We update this page whenever a sub-processor is added or removed, and email every customer account owner at least 30 days before a new sub-processor begins processing personal data, so they can object (see the Data Processing Agreement, section 7).
Questions
Contact us at privacy@rotahero.com.