Policy
Sub-processors
The companies Runless AS relies on to run QRSalt, what each one handles, and how data leaving Europe is protected.
Last updated 11 September 2026
Sub-processors
These process personal data on our behalf, including the data we process for business customers under our data processing agreement. Each is bound by a written contract with data protection terms at least as protective as ours.
| Provider | What for | Where | Transfer basis |
|---|---|---|---|
| DigitalOcean, LLC | Hosting: the application server, the database, uploaded files and backups. Data: Everything the service stores. | United States (New York, NYC region) | EU–US Data Privacy Framework and Standard Contractual Clauses in DigitalOcean’s data processing agreement (to confirm). |
| Cloudflare, Inc. | DNS, content delivery and caching, TLS, protection against attacks, approximate location of each request, and the Turnstile bot check. Data: IP address and request details for every visit and scan, in transit. | Global network; United States company | EU–US Data Privacy Framework and Standard Contractual Clauses in Cloudflare’s data processing addendum (to confirm). |
| Resend (Plus Five Five, Inc.) | Sending account and service email: sign-in codes, receipts, invitations, notices. Data: Recipient email address and the content of the message. | United States | Standard Contractual Clauses in Resend’s data processing agreement (to confirm). |
| Google LLC (Safe Browsing) | Checking the destinations of codes against lists of malware and phishing sites. Data: Destination URLs. Not linked to any person by us. | United States | EU–US Data Privacy Framework (to confirm the terms that apply to this API). |
Independent recipients
These receive personal data from or about you, but decide themselves how to use it under their own privacy policies. They are not our sub-processors.
| Provider | What for | Where | Transfer basis |
|---|---|---|---|
| Whop, Inc. | Checkout, payment and subscription management for paid plans. Data: Your name, email, billing details and payment method, collected by Whop. | United States | To confirm: Whop’s role (processor or independent controller) and transfer terms. |
| Google LLC / Google Ireland Ltd (Google Ads) | Measuring which ads lead to signups and purchases, only as the cookie policy allows. Data: Ad click identifier, visit and conversion events, IP address and browser details. | United States and Ireland | EU–US Data Privacy Framework; Google Ads Controller-Controller Data Protection Terms. |
| Google LLC (Sign in with Google) | Letting you sign in with a Google account, if you choose to. Data: Your name, email address and Google account identifier, sent to us by Google. | United States | EU–US Data Privacy Framework. |
Where your data is stored
Runless AS is a Norwegian company, but the service itself runs in the United States, on DigitalOcean in New York. That is a transfer out of the European Economic Area, and it is covered by the mechanisms listed against each provider above.
Changes to this list
We update this page before a new sub-processor starts handling customer data, and change the date at the top. Business customers can object to a new sub-processor as the data processing agreement describes. To be told about changes by email, write to [email protected] with the subject "Sub-processor updates".