Last updated: June 11, 2026 · ChienTech / PullPilot
ChienTech uses the following third-party service providers ("sub-processors") to deliver PullPilot. We have verified each provider's data protection commitments and have contractual data-processing agreements in place. Sub-processors are contractually prohibited from using your data for any purpose beyond what is stated here.
This page is the authoritative, standalone reference for our sub-processor list, maintained in accordance with GDPR Art. 28(2) and the CCPA service-provider definitions. The same list is also referenced from our Privacy Policy §4.
| Provider | Service | Data Processed | Legal Basis / Transfer Mechanism | Retention | Privacy Policy |
|---|---|---|---|---|---|
| Resend | Transactional email delivery | Email address, name, email content | EU-US DPF / SCCs | 30 days after delivery | resend.com/legal/privacy-policy |
| Google Firebase (FCM) | Push notification delivery | FCM device tokens, notification payloads | EU-US DPF | Until account deletion | firebase.google.com/support/privacy |
| Google Sign-In | OAuth identity (federated sign-in) | Google account ID, email address, name | EU-US DPF | Until account deletion | policies.google.com/privacy |
| Apple Sign-In | OAuth identity (federated sign-in) | Apple account ID, anonymized relay email | Apple DPA | Until account deletion | apple.com/legal/privacy |
| PostHog US Cloud | Product analytics & session recording | Events, session recordings (PII masked), anonymous device ID | EU-US DPF | 1 year | posthog.com/privacy |
| Google reCAPTCHA v3 | Bot detection & abuse prevention | Behavioral signals, IP address (transient) | EU-US DPF | Transient (not retained) | policies.google.com/privacy |
| Cloudflare R2 / AWS S3 | Photo storage | Uploaded photos (EXIF-stripped) | EU-US DPF / SCCs | Until photo deleted or report removed | cloudflare.com/privacypolicy |
| Railway | Application hosting & database | All application data in PostgreSQL | SCCs | Per retention schedule | railway.app/legal/privacy |
| Cloudflare CDN / WAF | Content delivery, DDoS protection, edge security | IP addresses, request logs | EU-US DPF | 7 days | cloudflare.com/privacypolicy |
| NHTSA vDecoder API | VIN decoding (make/model/year lookup) | VIN string only; no personal data sent | US Government — no transfer mechanism required | Not applicable | nhtsa.gov/privacy-policy |
All sub-processors listed above are located in the United States. If you access PullPilot from the European Economic Area (EEA), the United Kingdom, or Switzerland, your personal data is transferred to and processed in the United States under one or more of the following transfer mechanisms:
For questions about our transfer mechanisms or to request copies of relevant agreements, contact [email protected].
We review and update this sub-processor list whenever we onboard or remove a provider. Material changes — defined as adding a new processor that handles personal data — will be communicated to users at least 30 days before the change takes effect, via the email address on file.
Non-material changes (e.g. a provider's privacy policy URL update, location clarifications, or removal of a processor) may be made without advance notice, with the "Last updated" date above reflecting the revision.