Subprocessors
The providers that process data on our behalf.
Last updated: September 29, 2026
Controller: Lightpost One Ltd (trading as Rool), Dublin, Ireland
Contact: contact@rool.dev
Rool is built on infrastructure and services we do not run ourselves. This page is the formal register of those providers: who they are, what they do for us, what data they receive, and where they process it. Each provider does one job and receives only the data that job needs.
The privacy policy explains the same providers in plain language, and how data flows through Rool. This page is the reference version, and the one our data processing agreements point to.
We update this page and the change log at the bottom whenever we add, replace, or remove a provider.
Providers that run Rool
These providers are part of running Rool, so they are involved whenever you use it.
Hetzner (Finland)
Hosting of servers and storage
- Legal entity
- Hetzner Online GmbH, Germany
- Processing location
- Finland
- Data received
- All service data stored on those servers
- Added
- September 29, 2026
Verda (Finland)
GPU hosting for Rool's own AI models
- Legal entity
- DataCrunch Oy (trading as Verda), Finland
- Processing location
- Finland
- Data received
- Nothing is sent to Verda. Our models run on GPU servers it operates, so your messages, attached images, and the text of files the AI reads pass through that hardware while our models process them.
- Terms
- Infrastructure only. We deploy and run the models ourselves on isolated instances. Nothing is used for training.
- Added
- September 29, 2026
Google Cloud
Hosting, database, web app delivery, and sign-in
- Legal entity
- Google Cloud EMEA Limited, Ireland
- Processing location
- Finland (europe-north1); sign-in records and web app delivery may be outside the EU/EEA
- Data received
- Account data and usage records in the database (Cloud SQL), encrypted restore points of every machine (Cloud Storage), sign-in records, and web requests.
- Added
- September 29, 2026
Stripe
Payments
- Legal entity
- Stripe Payments Europe, Limited, Ireland
- Processing location
- EU and United States
- Data received
- Billing details when you buy a plan or credits
- Added
- September 29, 2026
Apple
Sign in with Apple and iOS in-app purchases
- Legal entity
- Apple Distribution International Ltd., Ireland
- Processing location
- EU and United States
- Data received
- Sign-in identifiers and purchase records, when you use them
- Added
- September 29, 2026
Resend
Email sending and receiving
- Legal entity
- Plus Five Five, Inc., United States
- Processing location
- United States (email is sent from Ireland, stored in the United States)
- Data received
- Email Rool sends you, and email your machine sends and receives, including its content
- Terms
- Stores email, including its content, under its own retention terms. Certified under the EU-US Data Privacy Framework.
- Added
- September 29, 2026
Speechmatics
Speech to text
- Legal entity
- Cantab Research Limited (trading as Speechmatics), United Kingdom
- Processing location
- EU (Speechmatics EU region)
- Data received
- Microphone audio, sent directly from your device
- Added
- September 29, 2026
Matomo
Website visit measurement for rool.dev
- Legal entity
- InnoCraft Ltd (Matomo Cloud), New Zealand
- Processing location
- Germany, with backups in Ireland
- Data received
- Page views and technical data, without cookies
- Added
- September 29, 2026
Google Workspace
Support email
- Legal entity
- Google Cloud EMEA Limited, Ireland
- Processing location
- EU (data at rest); processing may be outside the EU/EEA
- Data received
- Email you send to contact@rool.dev, and our replies
- Added
- September 29, 2026
Optional providers
These providers each power a specific feature and are only involved when you use it. Requests are sent from Rool’s servers under Rool’s account, not yours. You can turn each of them off in the app under Settings, Data and Privacy. The setting applies to requests you make. In a shared machine, other members’ requests follow their own settings, and can include content you have shared there.
TensorX (Ireland)
Backup AI models when Rool's own are unavailable or busy
- Legal entity
- TensorX Ltd., Ireland
- Processing location
- Ireland and Finland
- Data received
- Messages, conversation history including participant names, account details given to the AI such as plan and approximate location, attached images, and the text of files the AI reads
- Terms
- May not use your data to train AI models. Keeps nothing after answering.
- Added
- September 29, 2026
Google Cloud AI (Vertex AI)
Image generation and editing
- Legal entity
- Google Cloud EMEA Limited, Ireland
- Processing location
- EU
- Data received
- The description of the image you ask for, and the image you ask to edit
- Terms
- May not use your data to train AI models.
- Added
- September 29, 2026
Brave Software (Brave Search)
Web, image, and video search
- Legal entity
- Brave Software, Inc., United States
- Processing location
- United States
- Data received
- The search query, written by you or by the AI on your behalf
- Terms
- Keeps queries for up to 90 days. Does not treat queries as data it processes on our behalf.
- Added
- September 29, 2026
SerpApi
Google Scholar search
- Legal entity
- SerpApi, LLC, United States
- Processing location
- United States
- Data received
- The search query
- Terms
- Keeps searches for 31 days.
- Added
- September 29, 2026
Jina AI (Jina Reader)
Rendering web pages for the AI to read
- Legal entity
- Jina AI GmbH, Germany
- Processing location
- Not stated by Jina; requests pass through a global network and may be processed outside the EU/EEA
- Data received
- The address of the page
- Terms
- Does not train on requests. May keep the addresses it receives under its own terms. Owned by Elastic N.V. since October 2025; processing is governed by the Elastic Customer DPA.
- Added
- September 29, 2026
Transfers outside the EU/EEA
Your machines, files, conversations, and account data are stored in the European Union (Finland). Where a provider above processes or stores data outside the EU/EEA, we use appropriate safeguards such as Standard Contractual Clauses or equivalent protections.
Change log
- September 29, 2026: Register published, listing the providers already named in the privacy policy.
Contact
Questions about this register: contact@rool.dev