Subprocessors
Effective October 15, 2026
Arrebol Software LLC uses the service providers below to run UpRush. Each processes personal data only on our instructions and under written data protection terms, including standard contractual clauses where data leaves the EEA, UK or Switzerland.
Workspace owners who need advance notice of changes can email privacy@uprush.work to subscribe. We give subscribers at least 30 days’ notice before a new subprocessor receives customer data, and the right to object under our Data Processing Addendum.
Current subprocessors
| Provider | What it does for us | Personal data involved | Location |
|---|---|---|---|
| Supabase, Inc. | Database, authentication and file storage | All account data and workspace content | United States |
| Vercel Inc. | Application hosting, delivery and request logs | Data passing through requests; IP address and browser details in logs | United States (global edge network) |
| Resend (Plus Five Five, Inc.) | Sending email: sign-in codes, invitations, notifications, invoices | Recipient name and email address, and the content of the email | United States |
| Google LLC | Sign in with Google | Name, email address and profile picture, when you choose Google sign-in | United States |
| ImprovMX | Forwarding email sent to our addresses (such as privacy@ and legal@) to our support inbox | The messages you send us, including your email address | United States / European Union |
Other parties you may see
Stripe. Stripe and its affiliates process subscription payments as merchant of record and act as an independent controller under their own privacy policy, not as our subprocessor.
Integrations you connect. If a workspace connects Intuit QuickBooks or picks files from Google Drive, data moves between the Service and that provider because the workspace asked for it, under the provider’s own terms.
Advertising partners. Google, Meta and LinkedIn receive advertising and measurement data from our public marketing pages, as visitors’ cookie choices allow. They act as independent controllers and never receive Customer Content.
Public data. Exchange rates are fetched from a public dataset served by jsDelivr. No personal data is sent.