Softup LLC uses these service providers to run FurniOps. Each is bound by a contract to use the data only to provide its service to us. How we handle personal data is in the Privacy Policy.
1.Subprocessors
| Subprocessor | Purpose | Data |
|---|---|---|
| DigitalOcean, LLC | Hosting, in the Bengaluru, India region: the servers that run FurniOps with its databases and caches, and object storage for source snapshots, media and exports | All customer data and account data FurniOps stores |
| Cloudflare, Inc. | DNS, reverse proxy and CDN, TLS termination and DDoS protection | All traffic to FurniOps' public hosts passes through it: request metadata, IP addresses, and request and response content in transit |
| Resend | Transactional email sent by FurniOps (verification, sign-in, invitations, security alerts), from the United States; inbound email for file sources that receive vendor files by mail | Recipient email addresses and message content; for inbound mail, the sender's address and the attachments |
| Google LLC (Gemini API) | AI features: match judging, embeddings, AI agents (categories, mapping repair, onboarding, triage) and FurniOps AI | Catalogue content sent in prompts (product names, attributes, descriptions, images where used). By design not personal data, but files a customer supplies may contain any content |
| Stripe, Inc. | Billing: customers, subscriptions, invoices and payment methods. Card data goes to Stripe through its payment form, never to FurniOps | Billing contact, Stripe customer ID, usage quantities per meter, payment method (held by Stripe) |
| Grafana Labs (Grafana Cloud) | Metrics, logs and traces | Log lines carry request IDs, organisation IDs, user IDs, truncated IP addresses and user agents; credentials are redacted |
| Sentry | Error reports | Error context with IDs only; personal data is scrubbed before it is sent |
2.AI model providers
Google is the only AI model provider FurniOps uses. Adding another (such as Anthropic, OpenAI or a compatible provider) is a subprocessor change: it is listed here, with notice to customers, before it processes customer data.
3.Services that receive no personal data
| Service | Why it is not a subprocessor |
|---|---|
| GitHub, Inc. | Source code, CI and the container registry. No customer data is stored there. |
| Have I Been Pwned (Pwned Passwords range API) | When a password is set, only the first 5 hex characters of its SHA-1 hash leave FurniOps. |
| DB-IP (Lite databases) | IP-to-country and network files are downloaded and used locally to flag unusual API-key use; nothing is sent to DB-IP. |
| Vendors and sites FurniOps fetches | Data sources a customer directs FurniOps to. FurniOps sends them only the customer's own credentials for that vendor and ordinary HTTP requests. |
4.Changes
We update this list, and notify customers, before a new subprocessor processes customer personal data. Each version is listed below.
Version history
| Version | Effective | Change |
|---|---|---|
| 1.0 | First version. |