Sub-processors
Last updated: 13 October 2026
These are the providers that process personal data for the hosted Dealroom at dealroom.todo.law, what each one does and where. Rindogatan LLC operates Dealroom. Our privacy policy explains what we collect and why; this page lists who helps us run the service.
| What it does | Provider | Location |
|---|---|---|
| Hosting: serves the application and runs its server functions | Vercel | United States (iad1 region) |
| Database: stores accounts, deals, contract text and negotiation history | Neon, LLC (part of the Databricks group; the data processing addendum of Databricks, Inc. applies) | Frankfurt, Germany (European Union) |
| E-mail: sends sign-in links and deal notices | Resend | United States |
| Payments: charges for contracts and credits; keeps the card detailsPartly an independent controller for its own legal duties. | Stripe | United States and other countries |
| AI gateway and model provider: drafts and suggestions from the clauses being negotiated, routing each request to the model chosen. Its own sub-processors include large cloud and model providers that process the requestsOnly when AI features are switched on. Transfer safeguard: standard contractual clauses only, as the provider's documents state. | OpenRouter, Inc. | United States; the model provider that answers each request may be in another country |
| Web analytics: counts visits to our pages without setting cookies; receives the IP address of each page request, and we use only aggregated figures | Sealmetrics | Ireland and France, European Union |
Dealroom's data is stored in the European Union (Frankfurt). Its application servers run in the United States, so the data is processed there when you use the service.
If you choose to sign a contract with Firmas or to take a disagreement to Gavel, the details needed for that step go to that service. Rindogatan LLC also operates both; each has its own privacy notice and providers.
Sign in with Google (only if the user chooses it): Google LLC acts as an independent controller of the sign-in data under its Controller-Controller Data Protection Terms. It is not a sub-processor; we mention it for transparency.
Where a provider is in the United States or may be accessed from there, the transfer relies on the EU-US Data Privacy Framework where the provider is certified to it and otherwise on the standard contractual clauses approved by the European Commission. For the AI gateway provider, the safeguard is the standard contractual clauses only, as its row states.
We update this page before we add or replace a provider.