Legal
Subprocessors
The service providers ResellerHQ uses to process customer personal data: what each does, what it receives and where it is.
ResellerHQ (Enrich Labs LLC FZ) uses the service providers below to run the platform. Each receives only the personal data it needs for its job, under a written agreement with data protection terms no less protective than our Data Processing Agreement (DPA).
We name providers our customers already see in the product. The others are listed by category. Customers who have accepted our DPA can ask privacy@resellerhq.com for the names of every subprocessor; that list is shared in confidence.
| Category | What it does | Personal data it receives | Location |
|---|---|---|---|
| Cloud hosting provider | Runs the servers for the platform and its database | All customer personal data, stored on servers we operate | United States |
| Backup storage provider | Holds off-site copies of database backups | Encrypted files only; the provider cannot read them | United States |
| Hosts and sets up Google Workspace mailboxes | Mailbox users' names and email addresses, and the mailboxes themselves | United States and Google's global data centres | |
| Cloudflare | DNS for domains connected for mailboxes; bot protection on forms | Domain names and DNS records; visitors' IP address and browser signals | United States and Cloudflare's global network |
| Domain registrar | Registers and manages domain names | Domain names and their registrant, admin, tech and billing contacts | European Union |
| Phone number provider | Provides rented numbers and receives their SMS and calls | Rented numbers; sender numbers, message text and call transcripts | Hong Kong |
| Email delivery provider | Sends service emails (sign-up, receipts, alerts) | Recipient email addresses and email content | United States |
| Stripe | Card payments for wallet top-ups | The reseller's billing contact and payment details (held by Stripe) | United States |
| PostHog | Product analytics, only with consent | Usage events and masked session replays | United States |
Changes
We give resellers at least 30 days' notice, by email to the account owner and by updating this page, before a new subprocessor receives customer personal data. A reseller can object within that period; see the DPA.