Subprocessors.
ComplyRUO (Cevgate LLC, an Arizona limited liability company doing business as ComplyRUO, the “Company,” “we,” “us,” or “our”) uses a small number of trusted third-party providers (each a “subprocessor”) to host the service and process data on our behalf. This list forms part of our Privacy Policy and our Data Processing Addendum (the “DPA”). Each provider is bound by data-protection terms and may process personal data only to provide its service to us.
1.Current subprocessors
| Provider | Service to ComplyRUO | Data processed | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting and content delivery, application runtime (Workers), database (D1), key-value storage (KV), and static site hosting (Pages) for the marketing site, portals, and backend. | Merchant and affiliate account data, buyer attestation records, session tokens, and request logs. | United States, with a global edge network |
| Stripe, Inc. | Card and wallet payment processing through Stripe Connect on the merchant’s own connected account. | Payment and transaction metadata. Full card numbers go directly to Stripe and are not received or stored by ComplyRUO. | United States |
| Resend (Plus Five Five, Inc.) | Transactional email delivery (email verification, password reset, and account notifications). | Recipient email address and the contents of the message. | United States |
| Anthropic, PBC | AI text classification used by the weekly compliance scan to flag medical or human-use claims and missing disclaimers. | Publicly available content from the merchant’s storefront pages submitted for analysis. No buyer personal data is sent for this purpose. | United States |
| Google LLC | Advertising (Google Ads) and analytics (Google Analytics) on the public marketing site, to measure ad performance and show our ads to people who have visited, plus a single account-created conversion recorded at sign-up. Not otherwise used in the portals or at checkout. | Online identifiers and usage data of marketing-site visitors (cookie ID, device and browser information, pages viewed). No portal, buyer, or payment data. Opt-out and Global Privacy Control honored. | United States |
2.Merchant-configured providers
Some integrations run under the merchant’s own accounts and are the merchant’s subprocessors, not ours. In particular, optional SMS sign-in uses the merchant’s own Twilio account under the merchant’s agreement with Twilio. The merchant’s own Stripe account, WordPress host, and any analytics the merchant adds to its storefront are likewise outside this list and governed by the merchant’s arrangements with those providers.
3.Changes to this list, notice, and your right to subscribe
We may add or replace subprocessors as the service evolves. For changes that affect the processing of personal data we handle on a merchant’s behalf, we will update this page and, where required by the DPA, provide notice and an opportunity to object. The objection right, the notice period, the manner of objecting, and the sole and exclusive remedy are as set out in the DPA, and if the merchant does not object within the notice period stated in the DPA, the new or replacement subprocessor is deemed accepted.
The merchant may subscribe to subprocessor change notifications by emailing support@complyruo.com to be added to our subprocessor notification list. Once notice has been provided or this page has been updated, it is the merchant’s responsibility to stay current. The merchant’s continued use of the service after a subprocessor change constitutes acceptance of the updated list, subject only to the objection right described above.
Questions can be sent to support@complyruo.com.
4.Purpose of this list and precedence
This list is provided for transparency and convenience only. It is not a warranty, representation, or guarantee about any subprocessor’s location, conduct, performance, or security. ComplyRUO is not responsible for the acts or omissions of any subprocessor beyond the data-protection terms it has in place with that subprocessor, and locations, vendors, and offerings may change.
In the event of any conflict or inconsistency between this page and the DPA, the DPA controls. This page is informational and does not create rights or obligations beyond those set out in the DPA, the Privacy Policy, and the Terms of Service.