G-311Legal
Planbase Subprocessors
Related: Privacy Policy §9 · Data Processing Addendum §7 and Annex III · Data Retention and Deletion
Summary in plain language
These are the companies that handle personal data for Planbase Estimating LLC so we can run the website, accounts, licensing, email and error reports. Each works only on our instructions, under a written data processing agreement. Paddle and Google sign-in are listed too, for openness, but they decide for themselves how they use your data. We’ll give at least 30 days’ notice before adding or replacing a subprocessor.
1. Definitions
- “Subprocessor” means a company that Planbase engages to process personal data on Planbase’s behalf (for our own data) or on a business customer’s behalf (for data covered by the Data Processing Addendum).
- “Independent controller” means a company that receives personal data in connection with the Services but decides itself why and how it’s used, under its own privacy policy.
- Other terms have the meanings in the Privacy Policy §2.
2. Subprocessors
| Provider | What it does for us | Personal data it handles | Where | DPA and privacy terms |
|---|---|---|---|---|
| Cloudflare, Inc. (US) | Hosts every Site and our APIs (Workers); our databases (D1: planbase-core, planbase-site, planbase-docs-assistant); file storage (R2: dimsum-diagnostics, dimsum-updates, and DimSum Cloud storage when it opens); short-lived application logs; Email Routing (receives replies to our emails at replies.planbaseestimating.com, which our platform logs, and forwards them to our mailbox); Turnstile spam checks; Web Analytics; the help site’s “Ask the docs” assistant, when it’s turned on (Cloudflare AI Search and Workers AI answer the questions typed into it from our public help pages; no other AI provider is involved); Cloudflare Access for our admin panel; and, when it opens, the Remote Workstation’s connection broker and TURN relay |
Everything the Services store (account, Workspace, machine, audit, email-record, feedback, crash-report, diagnostics, tester, beta and newsletter data, billing records, email delivery events, CRM notes and the text of replies to our emails); request logs including IP addresses; Turnstile signals (IP address, browser data); questions typed into “Ask the docs” (whatever the visitor writes; we keep them, with emails and numbers removed, for 30 days, and count questions per day against a salted hash of the IP address, deleted after two days); Cloud Content when DimSum Cloud opens; encrypted Remote Workstation traffic it can’t read | Global network; stored data in the US | DPA: https://www.cloudflare.com/cloudflare-customer-dpa/ · Privacy: https://www.cloudflare.com/privacypolicy/ · Its subprocessors: https://www.cloudflare.com/gdpr/subprocessors/ |
| Clerk, Inc. (US) | Sign-up, sign-in (email code, password, Google), sessions, sign-in emails and codes, bot and fraud protection on sign-in | Name, email, password (hashed, held by Clerk only), Google account ID if used, session records, IP address, browser and device data, approximate location of sign-ins | US (Clerk hosts mainly in Google Cloud and Cloudflare) | DPA: https://clerk.com/legal/dpa · Privacy: https://clerk.com/legal/privacy · Its subprocessors: https://clerk.com/legal/subprocessors |
| Keygen LLC (US) | License records, seat and machine limits, machine activations | License ID and status, machine fingerprint (a hash), computer name, operating system, and our internal machine, user and Workspace IDs. Keygen is called only by our servers, so it doesn’t see your IP address | US | DPA: incorporated in Keygen’s terms, https://keygen.sh/terms/ · Privacy (subprocessors in §1.9): https://keygen.sh/privacy/ |
| Plus Five Five, Inc. (“Resend”) (US) | Sends our emails (invitations, license and trial notices, payment problems, tips, release emails, the weekly newsletter) | Recipient name and email address, the email’s content, delivery and bounce events (opens and clicks only if tracking is turned on) | US (us-east-1) | DPA: https://resend.com/legal/dpa · Privacy: https://resend.com/legal/privacy-policy · Its subprocessors: https://resend.com/legal/subprocessors |
| Functional Software, Inc. (“Sentry”) (US) | Error reports from our servers; automatic crash reports from DimSum if that is ever built and you turn it on (the crash reports you choose to send from DimSum today go to our own storage at Cloudflare, not to Sentry) | Today: the error, the address without its query string, and the host. Our servers send no request bodies, headers, cookies or customer input. Sentry receives requests from Cloudflare, not from your computer | US | DPA: https://sentry.io/legal/dpa/ · Privacy: https://sentry.io/privacy/ · Its subprocessors: https://sentry.io/legal/subprocessors/ |
| Google LLC (US) | Google Workspace: our email addresses (hello@, support@, privacy@, legal@, security@ and misuse@) are aliases of a Google Workspace mailbox, where we read and answer what you send | What you write to us, your email address and anything you attach | US and global | Cloud Data Processing Addendum: https://workspace.google.com/terms/dpa_terms.html · Privacy: https://policies.google.com/privacy |
3. Independent controllers (listed for transparency)
| Company | Role | What it receives | Terms |
|---|---|---|---|
| Paddle.com Market Limited (UK) and its affiliates, including Paddle.com Inc. (US) | Merchant of record: checkout, payment, sales tax and VAT, invoices, refunds, chargebacks and fraud checks | Name, email, billing address, payment details, IP address and country, tax IDs, purchase history | Privacy: https://www.paddle.com/legal/privacy · Data Sharing Addendum: https://www.paddle.com/legal/data-sharing-addendum · Where Paddle processes for us as a processor: https://www.paddle.com/legal/data-processing-addendum |
| Google LLC | “Continue with Google” sign-in, only if you choose it | Your Google sign-in, and that you signed in to Planbase | Privacy: https://policies.google.com/privacy |
4. Services we use that don’t handle customer personal data
Not subprocessors, listed so the picture is complete: GitHub (our source code), Microsoft Azure Artifact Signing (code signing for the installer and updates), Privacy.com (the cards Planbase pays its own vendors with), and our domain registrar. If any of these ever receives customer personal data, it will be added to §2 with notice under §5.
5. How we tell you about changes
5.1 Notice. At least 30 days before a new or replacement subprocessor starts processing personal data, we will:
- update this page and its “Last updated” date; and
- email everyone who has asked for subprocessor notices, and the admins of every Workspace that has signed our Data Processing Addendum.
To get notices, email legal@planbaseestimating.com with the subject “Subprocessor notices”.
5.2 Emergencies. If we must replace a subprocessor urgently (for example, it stops operating or has a security failure), we may do so with shorter notice and will tell you as soon as we can.
5.3 Objections. A business customer under the Data Processing Addendum may object to a new subprocessor on reasonable data-protection grounds within the 30 days, by email to legal@planbaseestimating.com. We’ll try in good faith to resolve it, for example by not using that subprocessor for the customer’s data. If we can’t, the customer may terminate the affected service by written notice before the change takes effect, and receives a pro-rata credit for the unused prepaid term, applied to its other Planbase fees (Data Processing Addendum §7.4).
5.4 Our responsibility. We choose subprocessors with care, bind each by written terms at least as protective as our Data Processing Addendum, and remain responsible for their work for us.
6. Change log
| Date | Change |
|---|---|
| 2026-10-07 | Version 1.0: Cloudflare, Clerk, Keygen, Resend, Sentry and Google Workspace as subprocessors; Paddle and Google sign-in as independent controllers |
| 2026-10-07 | Same day, added after attorney review (show at the next review): Cloudflare Email Routing (replies to our emails) and the CRM data (billing records, delivery events, notes, replies) in the Cloudflare row; still version 1.0 |
Planbase Estimating LLC, 3418 East 104th Street, Kansas City, MO 64137, USA. Questions: legal@planbaseestimating.com.All legal documents.