Subprocessors

Last updated October 9, 2026

These are the third parties that process personal data on Dronrly's behalf to provide the Service. Each is bound by a written contract that limits its use of the data to providing its service and requires appropriate security. This list forms part of our Data Processing Addendum; see also our Privacy Policy.

Current subprocessors

Stripe, Inc.

• Purpose: subscription billing for Dronrly plans, and invoice payments from a business's customers through Stripe Checkout.
• Data: business name, owner email, plan and subscription details; for invoice payments, the customer's email, invoice number, business name and amount. Card details are entered directly on Stripe and never reach Dronrly. Stripe is certified PCI DSS Level 1.
• Location: United States.
• Note: invoice payments run on each business's own Stripe account, under that business's agreement with Stripe. That account is either linked through Stripe Connect, where Dronrly stores only the account ID and uses "read_write" access as described in DPA section 3, or, for businesses that set up payments before Stripe Connect, reached with the business's own API keys, stored encrypted until they are deleted. Dronrly also reads balance, payment, refund and payout data from that account to show the business's payments dashboard.

Mailgun Technologies, Inc. (a Sinch company)

• Purpose: sending transactional email (invitations, password resets, job updates, quotes, invoices, receipts, account notices).
• Data: recipient name and email address, and the content of the email. Open and click tracking is turned off.
• Location: United States.

Cloudflare, Inc.

• Purpose: DNS, proxy and content delivery, DDoS protection, and Turnstile bot checks on the signup and contact forms.
• Data: all traffic to dronrly.com passes through Cloudflare, including IP addresses, request data and, for Turnstile, device and browser signals.
• Location: global network; company based in the United States.

Hosting

The application, database and uploaded files run on a dedicated server operated by Dronrly in [HOSTING LOCATION]. [HOSTING / DATA CENTER PROVIDER NAME, IF ANY]. Encrypted backups are kept for 30 days on a rolling basis.

Changes

We will update this page and email business owners at least 30 days before adding or replacing a subprocessor. A business may object on reasonable data protection grounds by writing to [email protected] within that period, as described in the Data Processing Addendum.