Subprocessors
Effective October 8, 2026
| Subprocessor | Entity | Function | Data processed |
|---|---|---|---|
| Vercel | Vercel Inc. (US) | Application hosting and scheduled jobs | Request traffic and runtime logs |
| GitHub | GitHub, Inc. (US, a Microsoft company) | Runs the scheduled backup job; the data passes through its infrastructure in transit between Supabase and Cloudflare R2 and is not retained there | The same population as the backup: the Service database (excluding authentication records) and all stored files |
| Supabase | Supabase Inc. (US) | Database, authentication, file storage | All Customer Personal Data stored in the Service |
| Resend | Resend Inc. (US) | Email transmission and receipt | Email sent and received through the Service, including bodies and attachments |
| Stripe | Stripe, LLC (US) | Subscription billing; and payments by Customer's clients on invoices, through Customer's own connected Stripe account | For subscription billing, Customer billing data (Business Contact Data; listed for transparency). For client payments, the invoice number, title and amount and Planlyx's own reference for the invoice, which Planlyx sends to create each payment page; Customer's name, sent to prefill the Stripe account Customer opens; the card or bank details, name, email address and billing address the payer enters on Stripe's page; and the payment status, amounts, dates, payment method type and reference numbers Stripe reports back |
| Cloudflare (Turnstile) | Cloudflare Inc. (US) | Automated-abuse prevention on public forms | Visitor IP address and browser signals |
| Cloudflare (R2) | Cloudflare Inc. (US) | Immutable offsite backup of the Service, for restoring Customer data after loss, corruption or deletion | A copy of the Service database (excluding authentication records) and of all stored files, including project files, plan sets and email attachments |
| Anthropic | Anthropic PBC (US) | The in-app assistant in the help panel | Messages typed into the assistant and the conversation they belong to; passages from Planlyx's own help guides; for subscription questions, the firm's plan name, subscription status, trial end date and active-project counts |
| Google Maps Platform | Google LLC (US) | Address suggestions, and address checks ("Did you mean…" and whether an enquiry's address matched), as a user types a project address into the Service or into Customer's public enquiry form | The address text being typed or checked and, for a chosen suggestion, Google's reference for that place. Sent from Planlyx's servers only: no name, contact details, IP address, Customer identity or form identity |
About the backup subprocessor. The backup exists so that Customer's records and documents survive events the primary provider's own recovery cannot address — including deletion or corruption that is not detected promptly. Copies are written to storage configured so that they cannot be modified or deleted for a fixed retention period: 90 days for the daily copy and 365 days for the monthly one. The lock cannot be removed by the backup system itself. Accordingly, a backup copy is not deleted during its retention period, including in response to a deletion request. Deletion in the live Service is carried out as Section 9 describes. The copies already taken cannot be removed early, and the periods above are minimums: a copy is not automatically destroyed when its lock expires. This is reflected in Section 9 and in the Planlyx Privacy Policy's retention section. Backups are never used to serve the Service and are read only to verify they remain restorable, or to perform a restore.
About the assistant subprocessor. Planlyx's agreement with Anthropic PBC prohibits training models on data submitted through it. Anthropic deletes submitted inputs and outputs within 30 days, except where content is flagged under its usage policy, in which case it may be retained for up to two years. No project files, plan sets, drawings, comments, client messages, invoices or contact records are transmitted to it. Planlyx deletes its own copy of each conversation 12 months after the conversation's last message.
About the address subprocessor. Planlyx's servers send Google the address text a user is typing (and, for a chosen suggestion, a Google place reference) to return suggestions and the chosen place's full address, and send the typed address when the field is left without a suggestion being chosen and when a public enquiry form is submitted, to check whether it matches a real address. Only the address text, a place reference and an opaque session identifier are sent — never a name, contact details, IP address, Customer identity or form identity — and the user's browser does not contact Google, so Google does not receive the user's IP address from Planlyx. Planlyx does not store the lookups; for an address submitted through a public enquiry form it records on the resulting deal only whether the address was matched, and the address a user chooses or types is stored as that user's own entry in the Service. Google's handling of the requests is governed by its Google Maps Platform terms and privacy policy.
(Until October 8, 2026, address suggestions came from Photon, operated by Komoot GmbH, called directly from the user's browser, and address checks from the U.S. Census Bureau's public lookup, called from Planlyx's servers. Both were replaced by Google Maps Platform on that date; neither receives data from Planlyx now. Until 2026-08-09, a project-location map embedded a frame served by the OpenStreetMap Foundation, and Planlyx's servers separately queried Photon to convert a saved project address into map coordinates; both were removed that day.)
(On October 2, 2026, the Stripe entity was corrected to Stripe, LLC, and Stripe's function was widened to payments by Customer's clients on invoices, through Customer's own connected Stripe account.)
The current subprocessor list is maintained at planlyx.com/legal/subprocessors.
(On October 8, 2026, Google LLC was added as a subprocessor for address suggestions and address checks, and the U.S. Census Bureau lookup was retired.)
Questions about this document: legal@planlyx.com