Rumor Subprocessors
Last updated: Sep 3, 2026
Rumor uses a small number of third-party companies to run its Services. Where one of them processes personal data on our behalf, it is a subprocessor, and it appears on this page. Each is engaged under a written agreement governing how it may handle that data.
Where you use Rumor to collect information about your guests, you are the controller of that information and we process it on your behalf. This page is the current list our Data Processing Agreements refer to.
Current subprocessors
| Subprocessor | Purpose | Categories of personal data | Location | Privacy notice |
|---|---|---|---|---|
| Amazon Web Services | Cloud hosting, file storage, queues and background processing | Account and profile data, event and guest records, uploaded photos and media, guest-list uploads and exports | United States (us-east-1) | Privacy notice |
| Vercel | Hosting for our web application, and routing of AI requests where the AI gateway is configured | Request and session metadata, IP address, page performance data; and, where the AI gateway is configured, the same prompt content that would otherwise go straight to the model provider — host-authored event page copy and images the host uploads | United States (provider-stated, not independently confirmed) | Privacy notice |
| Neon | Managed PostgreSQL database — our system of record | All application data, including account, event, guest and order records | United States (us-east-1) | Privacy notice |
| FusionAuth | Authentication and identity management | Email address, phone number, name, authentication credentials and tokens | United States (provider-stated, not independently confirmed) | Privacy notice |
| Prelude | Phone verification codes, fraud prevention and transactional SMS | Phone number, verification code, IP address, device and browser information, recipient first name, host and event name, message content | United States (provider-stated, not independently confirmed) | Privacy notice |
| Twilio | SMS and MMS message delivery | Phone number, message content, media attachments | United States (provider-stated, not independently confirmed) | Privacy notice |
| Twilio SendGrid | Transactional and event email | Email address, name, event details, invitation and ticket links, email engagement events | United States (provider-stated, not independently confirmed) | Privacy notice |
| Stream | In-app chat and messaging | Name or company name, profile photo, user identifier, email address, phone number, message content and attachments | United States (provider-stated, not independently confirmed) | Privacy notice |
| Google (Firebase Cloud Messaging) | Push notifications to mobile devices | Device push token, notification content | United States (provider-stated, not independently confirmed) | Privacy notice |
| Google (Maps Platform) | Address search, venue lookup, geocoding, address validation and time zones | Address and venue searches, postal addresses, location coordinates | United States (provider-stated, not independently confirmed) | Privacy notice |
| Google (Gemini) | Generating event flyers and venue maps, reading guest lists a host pastes in, and describing content in impact reports | Event content and images; where a host pastes a guest list, the names and email addresses in it; social content included in impact reports | United States (provider-stated, not independently confirmed) | Privacy notice |
| OpenAI | Search and discovery over member profiles, interpreting host search queries, and optional profile inference | Member profile text used to build search embeddings (name, profession, city, interests, social bio and post captions, professional headline, company and title), host search queries, and — where the optional inference feature is enabled — first name, social handle and profile photo | United States (provider-stated, not independently confirmed) | Privacy notice |
| Anthropic | Generating and editing AI-designed event pages for hostsGuest lists are not sent on this path. | Host-authored prompts and event page copy, event name, description and venue, and images the host uploads | United States (provider-stated, not independently confirmed) | Privacy notice |
| Algolia | Search across guest lists and events | Name, email address, phone number, Instagram handle, profession, gender, city, interests, follower counts, RSVP and check-in status | United States (provider-stated, not independently confirmed) | Privacy notice |
| Shaped | Search ranking and recommendations over member profiles | Profile attributes and search queries | United States (provider-stated, not independently confirmed) | Privacy notice |
| Modash | Public Instagram and TikTok profile and audience data for host reports | Instagram and TikTok handle, public profile and follower statistics, public post and story content | Not confirmed — Estonian company (provider-stated, not independently confirmed) | Privacy notice |
| Fiber AI | Professional profile enrichment from a LinkedIn URLNot used for events placed in processor-restricted mode — enrichment for those events is blocked before any data is sent, and fails closed. | Name, email address, LinkedIn profile URL, job title and company, and the public professional details returned for them | United States (provider-stated, not independently confirmed) | Privacy notice |
| Stripe | Payments, ticket sales and host payouts | Name, email address, billing and transaction data, and the identity and payout details a host provides to be paid | United States (provider-stated, not independently confirmed) | Privacy notice |
| Intercom | Customer support messaging and our help centre | Name, email address, account creation date, support conversations | United States | Privacy notice |
| PostHog | Product analytics, session replay, error monitoring, logging and feature flags | Account identifier and company name, usage events, device and browser information, IP address, page URLs and session recordings | United States | Privacy notice |
| RudderStack | Routing product and lifecycle events between our own tools | Name, email address, phone number, city, gender, date of birth, social handles, notification preferences and event participation | United States (provider-stated, not independently confirmed) | Privacy notice |
| Customer.io | Lifecycle and marketing messaging to hosts and members | Name, email address, phone number, city, gender, date of birth, social handles, notification preferences, device push token, and the events a person hosted or attended including check-in status | United States | Privacy notice |
| ClickHouse | Analytics warehouse for invite, activity and email engagement data | Email address, display name, invite and email engagement events | United States (us-east-2) (provider-stated, not independently confirmed) | Privacy notice |
| Cloudflare | Bot and abuse protection on our sign-in, sign-up and RSVP forms | IP address, browser challenge data | Global edge network | Privacy notice |
| Branch Metrics | Deep links that open the right screen in our mobile app | Device identifiers, IP address, link and referral data, and the invitation or RSVP identifier carried in a link | United States (provider-stated, not independently confirmed) | Privacy notice |
| Slack | Internal review and approval of applications to host on Rumor | Name, email address, phone number and Instagram handle of an applicant | United States (provider-stated, not independently confirmed) | Privacy notice |
Amazon Web Services
- Purpose
- Cloud hosting, file storage, queues and background processing
- Categories of personal data
- Account and profile data, event and guest records, uploaded photos and media, guest-list uploads and exports
- Location
- United States (us-east-1)
- Privacy notice
- Privacy notice
Vercel
- Purpose
- Hosting for our web application, and routing of AI requests where the AI gateway is configured
- Categories of personal data
- Request and session metadata, IP address, page performance data; and, where the AI gateway is configured, the same prompt content that would otherwise go straight to the model provider — host-authored event page copy and images the host uploads
- Location
- United States (provider-stated, not independently confirmed)
- Privacy notice
- Privacy notice
Neon
- Purpose
- Managed PostgreSQL database — our system of record
- Categories of personal data
- All application data, including account, event, guest and order records
- Location
- United States (us-east-1)
- Privacy notice
- Privacy notice
FusionAuth
- Purpose
- Authentication and identity management
- Categories of personal data
- Email address, phone number, name, authentication credentials and tokens
- Location
- United States (provider-stated, not independently confirmed)
- Privacy notice
- Privacy notice
Prelude
- Purpose
- Phone verification codes, fraud prevention and transactional SMS
- Categories of personal data
- Phone number, verification code, IP address, device and browser information, recipient first name, host and event name, message content
- Location
- United States (provider-stated, not independently confirmed)
- Privacy notice
- Privacy notice
Twilio
- Purpose
- SMS and MMS message delivery
- Categories of personal data
- Phone number, message content, media attachments
- Location
- United States (provider-stated, not independently confirmed)
- Privacy notice
- Privacy notice
Twilio SendGrid
- Purpose
- Transactional and event email
- Categories of personal data
- Email address, name, event details, invitation and ticket links, email engagement events
- Location
- United States (provider-stated, not independently confirmed)
- Privacy notice
- Privacy notice
Stream
- Purpose
- In-app chat and messaging
- Categories of personal data
- Name or company name, profile photo, user identifier, email address, phone number, message content and attachments
- Location
- United States (provider-stated, not independently confirmed)
- Privacy notice
- Privacy notice
Google (Firebase Cloud Messaging)
- Purpose
- Push notifications to mobile devices
- Categories of personal data
- Device push token, notification content
- Location
- United States (provider-stated, not independently confirmed)
- Privacy notice
- Privacy notice
Google (Maps Platform)
- Purpose
- Address search, venue lookup, geocoding, address validation and time zones
- Categories of personal data
- Address and venue searches, postal addresses, location coordinates
- Location
- United States (provider-stated, not independently confirmed)
- Privacy notice
- Privacy notice
Google (Gemini)
- Purpose
- Generating event flyers and venue maps, reading guest lists a host pastes in, and describing content in impact reports
- Categories of personal data
- Event content and images; where a host pastes a guest list, the names and email addresses in it; social content included in impact reports
- Location
- United States (provider-stated, not independently confirmed)
- Privacy notice
- Privacy notice
OpenAI
- Purpose
- Search and discovery over member profiles, interpreting host search queries, and optional profile inference
- Categories of personal data
- Member profile text used to build search embeddings (name, profession, city, interests, social bio and post captions, professional headline, company and title), host search queries, and — where the optional inference feature is enabled — first name, social handle and profile photo
- Location
- United States (provider-stated, not independently confirmed)
- Privacy notice
- Privacy notice
Anthropic
- Purpose
- Generating and editing AI-designed event pages for hostsGuest lists are not sent on this path.
- Categories of personal data
- Host-authored prompts and event page copy, event name, description and venue, and images the host uploads
- Location
- United States (provider-stated, not independently confirmed)
- Privacy notice
- Privacy notice
Algolia
- Purpose
- Search across guest lists and events
- Categories of personal data
- Name, email address, phone number, Instagram handle, profession, gender, city, interests, follower counts, RSVP and check-in status
- Location
- United States (provider-stated, not independently confirmed)
- Privacy notice
- Privacy notice
Shaped
- Purpose
- Search ranking and recommendations over member profiles
- Categories of personal data
- Profile attributes and search queries
- Location
- United States (provider-stated, not independently confirmed)
- Privacy notice
- Privacy notice
Modash
- Purpose
- Public Instagram and TikTok profile and audience data for host reports
- Categories of personal data
- Instagram and TikTok handle, public profile and follower statistics, public post and story content
- Location
- Not confirmed — Estonian company (provider-stated, not independently confirmed)
- Privacy notice
- Privacy notice
Fiber AI
- Purpose
- Professional profile enrichment from a LinkedIn URLNot used for events placed in processor-restricted mode — enrichment for those events is blocked before any data is sent, and fails closed.
- Categories of personal data
- Name, email address, LinkedIn profile URL, job title and company, and the public professional details returned for them
- Location
- United States (provider-stated, not independently confirmed)
- Privacy notice
- Privacy notice
Stripe
- Purpose
- Payments, ticket sales and host payouts
- Categories of personal data
- Name, email address, billing and transaction data, and the identity and payout details a host provides to be paid
- Location
- United States (provider-stated, not independently confirmed)
- Privacy notice
- Privacy notice
Intercom
- Purpose
- Customer support messaging and our help centre
- Categories of personal data
- Name, email address, account creation date, support conversations
- Location
- United States
- Privacy notice
- Privacy notice
PostHog
- Purpose
- Product analytics, session replay, error monitoring, logging and feature flags
- Categories of personal data
- Account identifier and company name, usage events, device and browser information, IP address, page URLs and session recordings
- Location
- United States
- Privacy notice
- Privacy notice
RudderStack
- Purpose
- Routing product and lifecycle events between our own tools
- Categories of personal data
- Name, email address, phone number, city, gender, date of birth, social handles, notification preferences and event participation
- Location
- United States (provider-stated, not independently confirmed)
- Privacy notice
- Privacy notice
Customer.io
- Purpose
- Lifecycle and marketing messaging to hosts and members
- Categories of personal data
- Name, email address, phone number, city, gender, date of birth, social handles, notification preferences, device push token, and the events a person hosted or attended including check-in status
- Location
- United States
- Privacy notice
- Privacy notice
ClickHouse
- Purpose
- Analytics warehouse for invite, activity and email engagement data
- Categories of personal data
- Email address, display name, invite and email engagement events
- Location
- United States (us-east-2) (provider-stated, not independently confirmed)
- Privacy notice
- Privacy notice
Cloudflare
- Purpose
- Bot and abuse protection on our sign-in, sign-up and RSVP forms
- Categories of personal data
- IP address, browser challenge data
- Location
- Global edge network
- Privacy notice
- Privacy notice
Branch Metrics
- Purpose
- Deep links that open the right screen in our mobile app
- Categories of personal data
- Device identifiers, IP address, link and referral data, and the invitation or RSVP identifier carried in a link
- Location
- United States (provider-stated, not independently confirmed)
- Privacy notice
- Privacy notice
Slack
- Purpose
- Internal review and approval of applications to host on Rumor
- Categories of personal data
- Name, email address, phone number and Instagram handle of an applicant
- Location
- United States (provider-stated, not independently confirmed)
- Privacy notice
- Privacy notice
Locations are the primary region in which each provider processes data for us. Several operate global infrastructure and may process or store data elsewhere; their own privacy notices, linked above, govern that detail. Some locations are the region the provider states, which we have not yet confirmed against our own configuration; those are marked with a dagger (†) and announced to screen readers as provider-stated. Unmarked locations we have confirmed ourselves. If a region matters to your transfer assessment, ask us and we will confirm it in writing.
Notice of changes, and your right to object
If you have a Data Processing Agreement with Rumor, we give you advance written notice before a new or replacement subprocessor starts processing your data. The notice tells you who the subprocessor is, what it will do, what categories of personal data it will handle, and where it will process them.
You may object to a new or replacement subprocessor on reasonable data-protection grounds. Your objection period is the one stated in your agreement — for most of our agreements that is 10 business days from the date of the notice. Your own DPA governs if it says something different.
To object, email support@therumor.com with the subprocessor named in the notice and the grounds for your objection. We will work with you to address it. If we cannot resolve it, you may terminate the affected Services as set out in your agreement.
To be notified of changes, or to ask for a copy of our Data Processing Agreement, email the same address.
Changelog
- Sep 3, 2026 — Initial publication of this page. The list was previously available on request; publishing it changes nothing about who processes data on our behalf.
Related
See our Privacy Policy and Terms of Service.