Who else handles your data.
The companies that process personal data on our behalf to run Drey, what they receive, where, and on what legal basis it leaves the EU.
Current subprocessors
We use these providers to run Drey. Each one processes data only on our instructions, under a data processing agreement.
| Provider | Purpose and data | Location and transfer basis |
|---|---|---|
| Oracle Cloud Infrastructure (Oracle) | Hosts the server that runs Drey's database, file storage and sign-in. All account data and content you store in Drey, including uploaded files. | Frankfurt, Germany (EU). Stored in the EU. Oracle's data processing agreement includes the EU Standard Contractual Clauses for any access from outside the EU. |
| Cloudflare, Inc. | Network delivery and protection in front of the Drey website and server (TLS, caching, denial-of-service protection). IP addresses, request metadata and the encrypted traffic that passes through its network. | Cloudflare's global network, usually a data centre near you; Cloudflare, Inc. is based in the United States. EU–US Data Privacy Framework certification and the EU Standard Contractual Clauses in Cloudflare's data processing addendum. |
| Resend (Plus Five Five, Inc.) | Sends account email: verification, sign-in confirmation, password reset and email change codes, a notice when an account deletion can't finish, and waitlist confirmations. Your email address, your name if it appears in the message, and the content of those emails. | United States. EU–US Data Privacy Framework certification, with the EU Standard Contractual Clauses in Resend's data processing agreement as a fallback. |
| Expo (650 Industries, Inc.) | Relays push notifications to the iOS app and delivers its over-the-air app updates. Push token, notification content (for example a task or event title), device and app version information and IP address. | United States. EU–US Data Privacy Framework certification, with the EU Standard Contractual Clauses in Expo's data processing addendum as a fallback. |
| Apple Inc. (Apple Push Notification service) | Delivers push notifications to your iPhone or iPad. Push token and notification content. | United States and Apple's global infrastructure. EU–US Data Privacy Framework certification and Apple's standard terms. |
What isn't on this list
- Software we run ourselves. Drey's database (Convex), file storage (Garage) and deployment tooling (Coolify) are open-source software running on our own server at Oracle. The companies that make them don't receive your data.
- Calendar feeds you add. When you subscribe to a calendar by URL, our server fetches that URL from the provider you chose. That provider is not working for us, and its own privacy policy applies.
- App stores. Apple handles your App Store download and account as an independent controller under its own privacy policy.
- Features that are switched off. Drey has code for paid plans (through Autumn and Stripe), but they aren't offered today and no data is sent to those providers. We'll add them to this list and update the Privacy Policy before turning them on.
Changes
We'll update this page before a new subprocessor starts receiving personal data, and tell you by email or in the app when the change is significant. Questions go to the privacy contact.
Privacy contact[email protected]