Subprocessors
Effective July 10, 2026 · Version 2
A subprocessor is a third-party service that processes personal data on Pluripo’s behalf in the course of providing the service. This page lists the subprocessors Pluripo currently uses, what each one does, where it processes data, and where to find its own privacy terms.
Current subprocessors
| Subprocessor | Purpose | Processing location | Privacy / terms |
|---|---|---|---|
| Stripe, Inc. | Payment processing, subscription billing, tax calculation | USA | https://stripe.com/privacy |
| Google LLC | Sign-in (OAuth 2.0); we receive your email address, Google subject identifier, and profile name | USA | https://policies.google.com/privacy |
| OpenRouter, Inc. | Proxying large-language-model requests to underlying model providers | USA | https://openrouter.ai/privacy |
| Fly.io, Inc. | Application hosting and managed Postgres database for the Pluripo backend and account portal | USA (San Jose, California) | https://fly.io/legal/privacy-policy/ |
| Cloudflare, Inc. | Static marketing site hosting and TLS termination for pluripo.com; isolated cloud sandboxes that run code generated in the web builder (filesystem and shell commands) and serve its live preview |
Global edge (sandboxes: USA) | https://www.cloudflare.com/privacypolicy/ |
| Resend, Inc. | Transactional email delivery (sign-in codes, billing and account notices); we share your email address and the message content | USA | https://resend.com/legal/privacy-policy |
Why these and not others
Pluripo’s traffic to underlying large-language-model providers flows through OpenRouter. OpenRouter is the entity Pluripo contracts with and the legitimate subprocessor in that chain. The underlying model providers act as OpenRouter’s subprocessors, not Pluripo’s, and are governed by OpenRouter’s terms. If Pluripo adds a direct integration with a model provider in the future, that provider will be listed here at the time it is added.
How we choose subprocessors
When evaluating a new subprocessor, we consider:
- whether the vendor publishes a public privacy policy and data-processing terms;
- whether the vendor offers appropriate security controls (encryption in transit, access controls, audit logging) for the category of data it handles;
- where the vendor processes data and what international-transfer safeguards apply;
- the vendor’s track record and reputation.
Changes to the list
Material changes to the subprocessor list — adding a new subprocessor, removing one, or replacing one — will be announced via in-app notice in the account portal. We do not currently offer an email-subscription mechanism for subprocessor change notifications; the in-app notice and this page (with a “Last updated” date) are the official channels.
Last updated: 2026-07-10. (Replaced E2B with Cloudflare for web-builder sandboxes; added Resend for transactional email.)
Contact
Questions about a subprocessor or about how your data is handled: privacy@pluripo.com.