Skip to content

Version 1.0 · Last updated: November 11, 2026

Sub-processors

The companies that handle personal data for BackPR, and what each one does.

Version 1.0 · Last updated: November 11, 2026
This is the same text the BackPR app shows at app.backpr.com/legal/subprocessors. Leer en español

These are the companies that handle personal data for BackPR. We tell organization owners by email at least 30 days before adding or replacing one.

Active

  • Cloudflare, Inc. (United States; global network). Hosting and running the application; one private database per organization; the shared account database; file storage and encrypted backups; background queues; sending BackPR's email (sign-in codes, receipts, reminders, notices and, unless your organization connected its own email provider, announcements); built-in AI features (translation, help answers, import mapping, summaries), which receive only the text sent for that feature; bot protection on sign-in, sign-up and checkout (Turnstile), which receives the visitor's network address and a browser challenge; page-view counts for public pages without names or emails; operational logs designed to exclude personal information.
  • Stripe, Inc. and its affiliates (United States, Ireland). Card and bank payments from families to an organization's own Stripe account; BackPR's own billing to organizations; the card check used by one of the sign-up modes. Receives payer name and email, amounts and the payment details people type into Stripe's own forms.

Not active

  • A text-message (SMS) provider (Twilio Inc., United States). The integration exists in the product but is switched off: no text messages are sent and no phone numbers are passed to it. This page will be updated before it is switched on.

Not our sub-processors

  • An email provider your organization connects with its own account (for example Resend, Postmark, SendGrid, Mailgun or Brevo) works for your organization, under your own agreement with it.
  • Analytics or advertising tags your organization adds to its own public pages (for example Google Analytics or Meta Pixel) are your organization's choice; they load only after the visitor agrees in the cookie banner on that page.
  • Your organization's own Stripe account is a direct relationship between your organization and Stripe.

Questions: hi@backpr.com