Subprocessors
Last updated: June 24, 2026
StatFlow ("we") uses the third-party providers below to operate the Service. Each subprocessor receives only the data reasonably necessary for its function. We require contractual commitments that limit use of Customer Data to providing services to us.
We may update this list when we add or replace providers. Material changes will be reflected here and, where appropriate, in our Privacy Policy.
Railway Corp.
- Purpose:
- Cloud hosting for API services and PostgreSQL/TimescaleDB databases
- Data processed:
- All application and metric data at rest; API traffic in transit through Railway infrastructure
- Location:
- United States (provider-selected region)
- Privacy:
- railway.com/legal/privacy
Vercel Inc.
- Purpose:
- Frontend hosting and deployment for the StatFlow web application
- Data processed:
- HTTP request metadata, session cookies in transit, static assets; no direct database access
- Location:
- United States / global edge
- Privacy:
- vercel.com/legal/privacy-policy
Stripe, Inc.
- Purpose:
- Payment processing and subscription billing
- Data processed:
- Customer email, plan, subscription and invoice identifiers; payment method handled by Stripe (we do not store full card numbers)
- Location:
- United States
- Privacy:
- stripe.com/privacy
Resend, Inc.
- Purpose:
- Transactional email delivery
- Data processed:
- Recipient email addresses and message content (verification, team invites, alerts, digests, billing notices)
- Location:
- United States
- Privacy:
- resend.com/legal/privacy-policy
Google LLC
- Purpose:
- Optional Google single sign-on (OAuth)
- Data processed:
- Email address, display name, and Google account identifier for authentication
- Location:
- United States / global
- Privacy:
- policies.google.com/privacy
OpenAI, L.L.C.
Optional / opt-in- Purpose:
- Optional AI inference when account-level AI features are enabled on eligible plans
- Data processed:
- Stat names, metric values, timestamps, metadata, alert text, and related context necessary to generate AI outputs (see Terms and Privacy Policy for scope)
- Location:
- United States
- Privacy:
- openai.com/policies/privacy-policy
Customer-directed destinations
When you configure alert webhooks, publish public dashboards, or embed charts, data may be sent to endpoints or viewers you choose (Slack, Discord, PagerDuty, your own HTTPS URLs, etc.). Those destinations are not StatFlow subprocessors unless we operate them on your behalf.
Questions
For subprocessor or DPA questions, contact support@doubleulabs.com.