Sub-processors
Effective Date: September 4, 2026 | Last Updated: October 25, 2026
A sub-processor is a company that processes personal data on our behalf so that we can run the Revquix Platform - a payment gateway, an email provider, an error monitor. This page lists every one of them. It is the companion to our Privacy Policy, which explains what we collect and why; this page answers the separate question of who else touches it.
We keep it on its own page, with its own date, so that adding or removing a vendor is a change we can publish immediately rather than one that waits for the next revision of a longer document.
We do not sell personal data, and none of the companies below is permitted to use what it receives for its own purposes. Where a row says consent-gated, nothing is sent to that company at all until you opt in through our cookie preferences.
1. Current sub-processors
1.1 Payments
| Company | What it does for us | What it receives |
|---|---|---|
| Razorpay | Takes payments charged in Indian Rupees, and issues the refunds against them | The card / UPI / net-banking details you enter on its hosted checkout, the amount, and contact details for the receipt. We never see or store a full card number |
| PayPal | Takes payments charged in US Dollars, including purchases of tool credits, and issues the refunds against them | Your PayPal or card details on its own checkout, the amount, and the order and capture identifiers we store against your purchase |
1.2 Sign-in
| Company | What it does for us | What it receives |
|---|---|---|
| Google (Identity) | “Continue with Google”, and the one-tap prompt described in Privacy Policy §2.1 | Google knows you are on a Revquix page when the prompt loads. We receive your name, email address and profile picture back - never your Google password |
| GitHub | “Continue with GitHub”; and, for Revquix Sites creators, hosts the private code repository a Component Studio block is submitted to as a pull request | Your name, username, email address and avatar. For a creator's submission: the block's files, and the creator's Revquix username and display name in the commit and the pull request |
| “Continue with LinkedIn” | Your name, email address and profile picture |
1.3 Sessions
| Company | What it does for us | What it receives |
|---|---|---|
| Google (Meet) | Hosts the meeting room each paid session takes place in. The room is created on a Google account Revquix owns - you authorise nothing and connect no account of your own | Whatever happens in the meeting, as it would for any Meet call, plus the attendance record we read back afterwards: display name, a participant identifier, and join and leave times. We request no Google Calendar scope and hold no calendar authorisation from anyone |
1.4 Storage, delivery and abuse protection
| Company | What it does for us | What it receives |
|---|---|---|
| Cloudflare | Stores uploaded files (R2), screens forms for bots (Turnstile), and serves the site (CDN and DNS). For Revquix Sites it also serves members' websites (Workers), stores their published files, counts their visits (Workers Analytics Engine) and issues the certificate for a member's own domain (custom hostnames) | Every file you upload - profile photo, resume, message attachment or project asset - and, for every request to the site, your IP address. For Revquix Sites: every file of a published site; for each visit to a member's site, the visitor's IP address and browser, and the visit record described in Privacy Policy§2.21, which holds a daily-changing scrambled visitor value rather than the IP and is kept for about three months; and the visitor's IP address when Turnstile checks a form on a member's site |
| Google (Web Risk) | Checks every link on a Revquix Site against Google's list of unsafe web pages before a version goes live, and checks live sites again every day | The web addresses being checked - the links on a member's site, and the site's own address - and nothing else: no visitor data and no account data |
1.5 Email
| Company | What it does for us | What it receives |
|---|---|---|
| Zoho (ZeptoMail) | Delivers transactional email - sign-in codes, booking confirmations, receipts, security notices, and the Revquix Sites emails to a site's owner, including each message a visitor sends through the site's form | Your name, email address, and the contents of the message being sent to you |
| Amazon Web Services, Inc. (Amazon SES) | Delivers product news, the newsletter, announcements from Revquix and outreach email, from its Mumbai region in India | Your email address, your name, the contents of the message being sent to you, and delivery events for it - whether it was delivered, bounced, or reported as spam |
| Zoho Campaigns (being retired) | Delivered the newsletter before we moved it to Amazon SES. New newsletter sign-ups no longer reach it | The name and email address of people who subscribed before the move, and whether they opened or unsubscribed |
1.6 Artificial intelligence
| Company | What it does for us | What it receives |
|---|---|---|
| DeepSeek | Generates the written parts of our career tools, the explanations, reviews and suggested edits in the code assistant, and the drafts and rewrites in Revquix Sites | Two different things, and the difference matters. Resume and job-description text is automatically redacted first - name, email, phone, postal address, date of birth and links become placeholders and each employer becomes a neutral label (Privacy Policy §2.10). Source code is not. When you ask the code assistant to explain, fix, review or document a file, that file is sent as written, so do not put passwords, API keys or other secrets in a file before pressing one of those buttons (Privacy Policy §2.12). Neither is “Generate my site”, which sends your profile as written, your name included, because the site it drafts is about you (AI Policy §3.3). Your Revquix account identifiers are never sent |
1.7 Analytics, diagnostics and advertising
Everything in this group is consent-gated: none of it loads, and none of it receives anything, until you opt into the matching category in cookie preferences.
| Company | What it does for us | What it receives |
|---|---|---|
| Google (Analytics 4) | Aggregate usage statistics | Pages visited and usage events, under Google Consent Mode v2 |
| Microsoft (Clarity) | Heatmaps and session replay, so we can see where a screen confuses people | Clicks, scrolls and navigation. We configure Clarity to mask text and form inputs |
| Sentry (Functional Software, Inc.) | Error monitoring, and a masked replay of the moments before an error | Error diagnostics and masked session data |
| Meta (Facebook / Instagram) | Advertising measurement and retargeting | Nothing at all unless you opt into the separate Advertising category, which is off by default |
1.8 Infrastructure
Revquix runs on servers we rent and administer ourselves from a cloud hosting provider. That provider does not use your data and cannot read our application data in the ordinary course, but it does host the machines the database and application run on, so we name the category here for completeness. Everything described in Section 2 runs on those machines.
2. What we run ourselves
Three things people reasonably assume are outsourced are not, and it changes who can see your data:
- Running your code. The Playground, Projects and the coding-problem judge execute your code in a sandboxed runner on our own servers. Your code is not sent to a third-party execution service. (Asking the AI assistant about your code is a separate act that does send it to DeepSeek - see §1.6 above.)
- Search that understands meaning. The model that turns profiles, mentors, services, documentation and your inferred interests into vectors for semantic search runs on our own infrastructure. No third-party AI provider receives that text.
- Your data at rest. The database, the cache and our application logs are ours, on the servers described in §1.8.
3. Services that receive no personal data
For completeness, because their absence from the list above is deliberate rather than an oversight: we fetch daily currency exchange rates from a public rates API. That request carries a three-letter currency code and nothing else - no account, no IP of yours, no identifier of any kind. It is not a sub-processor because it processes nothing about you.
Third parties a site owner chooses.On a website built with Revquix Sites, the owner may add embeds (a video, a song, a calendar, a map and the like) and, on their own domain only, analytics or advertising tools. The visitor's browser loads those directly from the provider the owner chose; Revquix does not send them anything. They are the owner's choice, not our sub-processors, and what they collect is described in our Cookie Policy §3.5.
4. International transfers
We operate from Pune, India. Several of the companies above process data outside India. Where we transfer EU/UK personal data internationally, we rely on appropriate safeguards such as the Standard Contractual Clauses. See Privacy Policy §5.
5. Changes to this list
We update this page when we add, remove or replace a sub-processor, and revise the “Last Updated” date above. Where a change materially affects how your data is handled, we will also say so in-product or by email, as our Privacy Policy requires.
6. Contact
Questions about anything on this page, including a request for more detail about a particular vendor relationship:
RevquixPune, Maharashtra, India
Email: [email protected]