Draft. Needs a lawyer's review before use. Nothing on this page is in force yet.
Sub-processors
These are the companies Dunly uses to run the service that handle your customers' personal data. This list is Annex IV of the data processing agreement. We email you at least 30 days before adding or replacing one, and you can object (see the DPA, Clause 7.7).
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Stripe (Stripe Payments Europe, Limited, Ireland; Stripe, LLC, United States) | Payments: reading invoices, invoice payments, charges, refunds, disputes, customers and payment methods on your connected Stripe account; collecting card details in Stripe's own form; charges and retries | Payment data, customer email and name | Ireland and the United States. Stripe says it runs data centres in the United States and India, limits global storage to authentication and security data, and may transfer data globally under its own terms. |
| Resend (Plus Five Five, Inc., United States) | Email delivery: recovery emails to your customers, sign-in codes, bounce and complaint reports | Recipient's email address, not their name; the email's content: merchant name, amount, deadline, invoice number and description, payment link, support address and logo link; ids of the case and organization. For Dunly's own emails: the recipient's address and the content. | United States. Resend's terms allow other transfers outside the EEA. |
| Cloudflare, Inc. (United States) | DNS for trydunly.com and forwarding of mail to hello@trydunly.com; records are DNS only today, so traffic to Dunly does not pass through Cloudflare | Mail sent to hello@trydunly.com | Global network. Cloudflare's terms allow processing outside the EEA, the UK and Switzerland. |
| TO FILL IN (mailbox provider) | The mailbox that receives mail Cloudflare forwards from hello@trydunly.com | Mail sent to hello@trydunly.com | TO FILL IN |
| Hetzner Online GmbH (Germany) | Hosting: the server that runs Dunly's application and database | All data Dunly stores | TO FILL IN (data centre) |
| Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg, if the account's country is in Europe, the Middle East or Africa; TO CONFIRM the account's country) | Storage of database backups | All data Dunly stores, in backup files | TO FILL IN (S3 region) |
Transfers outside the EEA, as checked on 2026-11-03. We checked the EU-US Data Privacy Framework list at https://www.dataprivacyframework.gov/list on that date. It showed Stripe, LLC, Cloudflare, Inc. and Amazon.com, Inc. as active. AWS says it is covered by the Amazon.com, Inc. certification. It showed Resend as "Active - Re-certification under Review". That status can change, so check the list for the current one. The data processing terms of Stripe, Resend, Cloudflare and AWS also provide for the European Commission's standard contractual clauses.
Hetzner. Hetzner's data processing agreement says it processes data only in the EU or the EEA, and that a transfer to a third country needs the customer's prior consent. Hetzner also offers data centres in the United States and Singapore, so this holds for Dunly once the data centre above is filled in and is in the EEA. (TO CONFIRM.)
AWS. AWS keeps customer data in the region the customer chooses, except as needed for services the customer starts or to comply with the law.
Stripe's role. Your Stripe account is your own agreement with Stripe. Under Stripe's data processing agreement, Stripe acts as a processor for you when it provides its payment services, and as an independent controller for its own purposes, such as fraud monitoring and legal compliance. Dunly reads and acts on your account only as you instruct it through the connection you authorise.
The providers' own terms. Data processing agreements: Stripe, Resend, Cloudflare, Hetzner and AWS. Their own sub-processors: Resend and AWS; Hetzner's are in Appendix 3 of its agreement.
How Dunly bills is in the terms.
Last updated: 2026-11-03 (draft).