RunsOn Service Providers and Subprocessors

Effective date: June 5, 2026

This page lists the main third-party providers that may process personal data for RunsOn-side operations.

Some providers act as subprocessors only when RunsOn acts as a processor for customer-provided support materials under agreed processor terms. Other providers act as processors, independent controllers, or mixed-role providers for RunsOn's controller-side business operations, such as billing, payment, website analytics, advertising measurement, source hosting, support, and ordinary business communications.

RunsOn uses EU/EEA providers where practical. For non-EEA providers, RunsOn relies on the vendor's published data-protection terms, adequacy decisions, standard contractual clauses, the EU-U.S. Data Privacy Framework where applicable, or another valid transfer mechanism.

Cloudflare. RunsOn uses Cloudflare for website hosting, CDN, security, request routing, and RunsOn-side API endpoints. For RunsOn-side data, Cloudflare acts as a processor/subprocessor for request routing and API hosting, and as a controller for limited account/security processing under its own terms. The legal entity is Cloudflare, Inc. (United States). Cloudflare operates a global edge network; processing location depends on the service and traffic route. Relevant data categories are website request data, approximate request metadata, license validation data, and minimal diagnostics. Vendor terms: DPA and subprocessors.

Hetzner. RunsOn uses Hetzner for infrastructure hosting where used. For RunsOn-side data, Hetzner acts as a processor/subprocessor for hosted infrastructure. The legal entity is Hetzner Online GmbH (Germany). Processing location depends on the selected product location; Hetzner states that US or Singapore cloud locations transfer only data stored on the selected cloud server to that location. Relevant data categories are website, API, account, operational, or support data depending on deployment. Vendor terms: data protection and DPA.

Stripe. RunsOn uses Stripe for checkout, subscriptions, invoices, payments, billing records, the billing portal, and payment-related webhooks. For RunsOn-side data, Stripe acts as a mixed controller/processor payment provider under Stripe terms. For RunsOn's France-based Stripe account, the Stripe contracting entities are Stripe Payments Europe, Limited (Ireland) and Stripe Technology Europe, Limited (Ireland), with other Stripe affiliates, banks, card networks, and fraud-prevention systems involved in payment processing where applicable. Payment processing may involve international transfers under Stripe terms. Relevant data categories are customer identity, billing contact, payment, invoice, subscription, tax, transaction, fraud-prevention, and payment metadata. Vendor terms: DPA, privacy center, and service providers.

Lemon Squeezy. RunsOn uses Lemon Squeezy for legacy or redirected billing flows where applicable. For RunsOn-side data, Lemon Squeezy acts as a mixed controller/processor payment and merchant-of-record provider under Lemon Squeezy terms. The legal entity is Link, LLC f/k/a Lemon Squeezy LLC (United States). Lemon Squeezy is a legacy billing flow and currently a Stripe-owned service. Relevant data categories are customer identity, billing contact, payment, invoice, subscription, tax, transaction, and support data. Vendor terms: DPA, privacy, and terms.

Ahrefs. RunsOn uses Ahrefs for optional website analytics and SEO analytics after visitor consent where enabled. For RunsOn-side data, Ahrefs acts as a processor/service provider under Ahrefs terms for analytics data, and may act as controller for its own account or service data under its privacy policy. The legal entities are Ahrefs Pte. Ltd. (Singapore) and Ahrefs Services LLC (United States) for US terms where applicable. Analytics processing location depends on Ahrefs services and subprocessors. Relevant data categories are website usage analytics, request metadata, referral, SEO, and crawl data. Vendor terms: legal center, DPA, US DPA, and subprocessors.

Google Ads / Google. RunsOn uses Google Ads / Google for optional advertising measurement after visitor consent where enabled. For RunsOn-side data, Google acts as a mixed controller/processor depending on the Google Ads or measurement service and accepted Google terms. For RunsOn's France-based Google Ads account, the account is generally served by Google Ireland Limited (Ireland); Google France SARL may be the counterparty for affected products if Google notifies RunsOn that those terms apply. Advertising measurement may involve Google services, affiliates, and international transfers under Google data-protection terms. Relevant data categories are ad click identifiers, conversion event metadata, consent status, landing page metadata, and approximate request or device metadata handled by Google Ads. Vendor terms: Ads data processing terms, Ads controller terms, Ads data transfers, and privacy.

Fastmail. RunsOn uses Fastmail for email hosting and ordinary business communications. For RunsOn-side data, Fastmail acts as a processor or mixed-role provider under Fastmail terms, depending on account and communication data. The legal entity is Fastmail Pty Ltd (Australia). Fastmail operates email service from Australia and other infrastructure locations under Fastmail terms. Relevant data categories are email content, contact details, support, procurement, billing, and account communications. Vendor terms: DPA and privacy.

Slack. RunsOn uses Slack for support communications, including Slack Connect where included. For RunsOn-side data, Slack acts as a processor/subprocessor for workspace customer data, and as a controller for Slack account and service data under Slack terms. For RunsOn's France-based Slack workspace, the Slack contracting entity is Slack Technologies Limited (Ireland). Slack Connect and support communications may involve Salesforce/Slack affiliates and international transfers under Slack terms. Relevant data categories are support communications, contact details, shared logs, screenshots, configuration snippets, and Slack workspace metadata if sent by Customer. Vendor terms: DPA, privacy, and subprocessors.

GitHub. RunsOn uses GitHub for source hosting, release workflows, issue tracking, source access records, and support workflows where applicable. For RunsOn-side data, GitHub acts as a mixed controller/processor under GitHub terms; GitHub is processor where an organization controls GitHub organization account data under its GitHub agreement. The legal entities are GitHub, Inc. (United States) and GitHub B.V. (Netherlands) depending on processing context. Processing may involve GitHub, Microsoft affiliates, and international transfers under GitHub terms. Relevant data categories are GitHub account identifiers, source access records, issue or pull request content, release workflow metadata, and support materials if sent through GitHub. Vendor terms: DPA, privacy, subprocessors, and customer terms.

Customers should not send secrets or unnecessary personal data in support materials. If a Customer needs special restrictions for support materials, offline use, no diagnostics, restricted diagnostics, custom processor terms, or a signed data processing addendum for a specific support scenario, contact ops@runs-on.com before purchase or before sending the materials.