Legal
Subprocessors
The third-party service providers Regencly uses to host, operate and support the platform, what each one does, and where the data is processed.
Last updated: 2026-07-05
Regencly (Meridian Labs, LLC) engages the third-party subprocessors listed below to help provide the Service. We bind each subprocessor to data-protection obligations no less protective than our Data Processing Addendum, and we give at least 30 days' advance notice before adding or replacing a subprocessor. To be notified of changes, email privacy@regencly.com.
Core subprocessors
These vendors process personal data on our behalf in the course of providing the Service.
| Subprocessor / legal entity | Purpose | Data processed | Region |
|---|---|---|---|
| Google Cloud Platform / Firebase (Google LLC) | Core cloud infrastructure and backend platform: Firestore (primary datastore for tenants, users, leads, listings, CRM connections), Cloud Storage (media and published sites), Firebase Auth (identities), and Cloud Functions / Cloud Run / App Hosting (backend compute and SSR). | User identities, leads and lead activity, CRM contacts, listing and media data, and other tenant/site content stored and served for the Service. | United States. |
| Google Cloud Key Management Service (Cloud KMS) (Google LLC) | Envelope-encryption key management for the credential vault that protects tenant MLS/CRM API keys and OAuth tokens. | Cryptographic key material and transient encrypt/decrypt operations on credentials. KMS does not persist the plaintext credentials themselves (those live as ciphertext in the app datastore). | United States. |
| Stripe (Stripe, Inc.) | Payment processing and subscription billing: plan checkout, recurring billing, invoicing, card capture (PCI scope on Stripe's side), and entitlement/plan state via webhooks. | Billing and contact data, card/payment data (held in Stripe's PCI environment), and subscription/entitlement metadata. | Primarily United States. Global processor; relies on Standard Contractual Clauses for EEA/UK data. Stripe acts as an independent controller for some processing (e.g., fraud prevention, regulatory obligations) and as a processor for the rest. |
| Resend (Plus Five Five, Inc.) | Transactional and marketing/newsletter email delivery. | Recipient email addresses, message content, and email metadata/logs (sends, opens, delivery events). | United States; account data (metadata, logs, contacts, API records) is stored in the US regardless of the selected sending region. EU-US Data Privacy Framework certified. |
| Cloudflare (Cloudflare, Inc.) | Edge network / CDN and DNS used to publish tenant sites on custom domains; via Cloudflare-for-SaaS Custom Hostnames it provisions SSL/TLS certificates, proxies and caches HTTP traffic at the edge, and provides DDoS protection. | End-visitor IP addresses, HTTP request metadata, and TLS SNI/hostnames (for certificate issuance). | Global anycast edge (200+ PoPs); metadata/logs processed primarily in the US and EU. Optional Data Localization Suite available. |
| Google Gemini (Generative AI) (Google LLC) | LLM text generation and vision/document extraction: AI-generated site content, newsletters, neighborhood and SEO copy, extraction of details from publicly available agent profiles, and AI search visibility features. | Prompt and response content, which can contain tenant/site/agent/property personal data. | United States / Google global infrastructure (no region-residency guarantee on the Gemini Developer API). We use the paid tier, so prompts and responses are not used to train Google's models. |
| OpenAI (OpenAI, L.L.C.; SCC signatory: OpenAI OpCo, LLC) | LLM text generation for AI-authored site/SEO/marketing copy and AI search visibility features. Used only when enabled; Gemini is the current default provider. | Prompt content, which can contain tenant/site/agent/property personal data. No data is sent while it is not enabled. | United States; relies on Microsoft (Azure) as an upstream subprocessor. SCCs offered for EEA/UK transfers. |
| Google reCAPTCHA Enterprise (Google LLC) | Bot and abuse protection on public-facing forms (newsletter signups, lead-capture, contact forms) on tenant/agent sites, scoring each submission before a lead or subscriber is accepted. | End-user IP address, the reCAPTCHA token, and browser/device and interaction (behavioral) signals from form visitors. | Global; primarily United States. As of 2026-04-02, Google provides reCAPTCHA as a data processor under the Cloud DPA. |
| OpenTelemetry OTLP → Google Cloud Trace (Google LLC) | Distributed tracing / observability. OpenTelemetry itself is an open-source library that processes no data on its own servers; the effective subprocessor is the OTLP endpoint operator, which defaults to Google Cloud Trace. | Trace spans, which can carry personal data (request URLs/paths, IP addresses, user/session identifiers, custom attributes). | Google global infrastructure; Cloud Trace spans default to the US multi-region. |
Planned (not yet live)
- Twilio (Twilio Inc.). The AI voice feature is not part of V1. When the voice feature launches, Twilio will be added as a subprocessor (call audio, phone numbers), along with the call-recording/consent obligations that entails. Marketing SMS is handled through the customer's connected CRM/ESP (see below), not Twilio.
Other service providers (not personal-data subprocessors)
The following vendors are part of the Service's technology stack but do not process our customers' or their end-users' personal data on our behalf, so they are not personal-data subprocessors. They are listed here for transparency:
- DataForSEO (DataForSEO OÜ, Estonia; company No. 14502291). Live SERP, keyword/search-volume, and rank-tracking data for the SEO engine. Receives tenant domains and tracked SEO keywords: public search-query data, not personal data.
- Google Search Console / PageSpeed Insights / Indexing / Site Verification APIs (Google LLC). SEO and search-performance telemetry for a tenant's own published site (aggregate impressions/clicks/positions, page and sitemap URLs, Core Web Vitals field metrics, domain-ownership verification tokens). This narrow API scope handles Google-controlled SEO telemetry, not end-user personal data processed on our behalf. Note that Google LLC is separately a core subprocessor at the entity level via Firebase, Cloud Run, Gemini, reCAPTCHA, and Cloud Trace above.
- Bridge Interactive (Bridge Interactive Group, LLC, a Zillow Group company). Inbound MLS/IDX listing-data source (RESO Web API / OData feeds and property media) for display on agent/brokerage sites. Data flows one-way in; we do not send our customers' end-user personal data to Bridge to process on our behalf. (The ingested feeds do contain third-party listing-agent personal data flowing inbound.)
- CoreLogic Trestle (CoreLogic Solutions, LLC, d/b/a "Cotality"). Inbound MLS listing-feed source (RESO Web API / RETS) for brokerage tenants. Like Bridge, it is a licensed data supplier, not a processor of our customers' personal data.
- Nominatim / OpenStreetMap (The OpenStreetMap Foundation Limited, UK). Server-side geocoding of place/neighborhood names and address strings, plus OSM amenity lookups for neighborhood/location pages. A free, no-contract public service; the queries sent are public geographic reference strings, not end-user personal data.
Customer-connected integrations (not Regencly subprocessors)
When a customer connects their own CRM or email/marketing provider (for example Follow Up Boss, Mailchimp, Constant Contact, or ReChat), those providers are the customer's chosen tools, not Regencly subprocessors. Data flows to them at the customer's direction through the customer's own account and credentials. The customer is responsible for its relationship with, and the terms of, those providers, including any data-processing terms and disclosures they require.
Regencly is a brand of Meridian Labs, LLC, 8992 Chauvet Way, Boca Raton, FL 33496.