PatentRef Processors and Data Processing Agreements

Effective: 2026-11-09. Version: beta-4. Part of the Privacy Policy at patentref.io/docs/legal/privacy (section 3). Controller: Aaron Baker, Tucson, Arizona, United States.

This register lists every provider that processes personal data for the PatentRef service, what it processes, where, under which data processing agreement, and on what basis personal data of people in the EU, the UK or Switzerland reaches it. A provider is added here before it receives personal data. The last line of each entry says how its agreement took effect for the PatentRef account; "pending" means it still has to be concluded.

Hetzner Online GmbH (Germany)

• Role: hosting. The server that runs the API, the account database, the waitlist, the request logs and the snapshots (Helsinki, Finland), and the off-box copy of the nightly backups on a Hetzner Storage Box, sent there over SSH and not encrypted by us.
• Personal data: account email, user id, key records, request log rows (time, key prefix, path, status, client IP address), web server access logs, waitlist addresses with their choices and dates; the backups hold the same.
• Location: the EU (Finland and Germany). No transfer outside the EU.
• Agreement: Hetzner's data processing agreement under Article 28 GDPR, concluded in the customer account at https://accounts.hetzner.com/account/dpa (the text: https://www.hetzner.com/AV/DPA_en.pdf).
• In force: concluded in the customer account on 2026-10-08.

Supabase (United States)

• Role: sign-in and email confirmation (Supabase Auth); when the registry opens, the registry database and file storage.
• Personal data: email address, hashed password, sign-in events, and registry submissions when the registry opens.
• Location: the Central EU (Frankfurt) region, eu-central-1, for the PatentRef project; the company is in the United States.
• Agreement: the Supabase Data Processing Addendum, https://supabase.com/legal/dpa. It forms part of Supabase's terms of service (the contracting entity there is Supabase Pte. Ltd.).
• Transfer basis: the standard contractual clauses incorporated in that addendum, with the UK addendum and the Swiss changes.
• In force: part of Supabase's terms of service, accepted when the account was opened; there is no signature step.

Resend (Plus Five Five, Inc., United States)

• Role: delivery of the account email that Supabase Auth sends and of the waitlist mail (sender noreply@mail.patentref.io), and the delivery events (delivered, bounced, complained) that keep a bounced address from being mailed again.
• Personal data: recipient email address, the message, delivery events.
• Location: the United States.
• Agreement: the Resend Data Processing Addendum, https://resend.com/legal/dpa.
• Transfer basis: the standard contractual clauses in that addendum, with the UK addendum and the Swiss changes, and the EU-US Data Privacy Framework, to which Resend is certified.
• In force: from sign-up, as part of Resend's terms of service; no separate signature.

Google LLC (United States)

• Role: Google Workspace for the PatentRef mailboxes, and Google Drive for a nightly copy of the backup of the account database and the waitlist, sent over HTTPS and not encrypted by us; Google encrypts files in Drive at rest (https://support.google.com/drive/answer/10519333). Google Cloud (BigQuery) is used only to read public patent datasets and receives no personal data of users.
• Personal data: mail sent to the PatentRef addresses; the backup file (account data and the waitlist).
• Location: the United States and Google's other regions.
• Agreement: the Cloud Data Processing Addendum, https://workspace.google.com/terms/dpa_terms.html for Google Workspace and https://cloud.google.com/terms/data-processing-addendum for Google Cloud (accepted in the Admin console and the Cloud console).
• Transfer basis: the standard contractual clauses incorporated in that addendum, and the EU-US Data Privacy Framework.
• In force: the Cloud Data Processing Addendum, accepted on 2026-10-22 for the PatentRef account (aaron@omnipoolbuilders.com).

UptimeRobot (UptimeRobot s. r. o., Slovak Republic)

• Role: the outside uptime check of the public health route.
• Personal data: none of PatentRef's users. It requests one public URL and records whether it answered; the account holds only the operator's own email.
• Location: mainly the EU, with the United States as its second location.
• Agreement: UptimeRobot's data processing agreement, https://uptimerobot.com/dpa/.
• In force: with UptimeRobot's terms of service; no separate signature.

GitHub, Inc. (United States)

• Role: the code repositories, and the public uptime probe that runs on GitHub Actions.
• Personal data: none of PatentRef's users. The probe records only whether the health route answered.
• Location: the United States.
• Agreement: none is needed while GitHub receives no personal data of users. GitHub's Data Protection Agreement, https://github.com/customer-terms/github-data-protection-agreement, covers its paid business plans, if one is used later.
• In force: not needed.

Not yet used

• Stripe, Inc., for payments, only when paid plans start, and never before you choose to pay. It will be added here with its agreement before the first charge.