Data Processing and Subprocessors
This page names every third party that processes personal data on RentBear's behalf, and explains the terms they do it under. It supports our Privacy Policy, which is where the full picture of what we collect and why lives.
1. Our Role
For personal data about the people who use RentBear, Hi Bear LLC is the data controller: we decide what is collected and why. The providers below are our processors — they act on our documented instructions and for no purpose of their own. Each is bound by a data processing agreement that meets Article 28 of the GDPR, including confidentiality, security, assistance with your rights, and deletion or return of the data when the contract ends.
2. Subprocessors
We keep this list short on purpose. Every provider here is one the service cannot run without.
| Provider | What it is for | What it processes |
|---|---|---|
| Supabase | Authentication and identity | Email address, hashed credentials, sign-in metadata |
| MongoDB | Primary application database | Account data, saved searches, profiles, matches and messages |
| Stripe | Payments and subscription billing | Billing details, payment status, invoices. Card numbers go to Stripe, never to us |
| Expo | Mobile push notification delivery | Push token, device type, the content of the alert |
| Resend | Transactional and contact-form email | Email address, name and message content |
| Cloudflare | Website hosting, content delivery and security | IP address and request metadata, in transit |
Not every provider touches every account. Stripe only processes anything if you take a paid plan; Expo only if you use the mobile app and turn on push.
We do not use advertising networks, data brokers or analytics providers, and no listing site we crawl receives anything about you.
3. International Transfers
Some of these providers are established outside the European Economic Area, or run infrastructure outside it. Where that is the case we rely on an adequacy decision of the European Commission, or on the Standard Contractual Clauses together with the additional technical and organisational safeguards the transfer calls for. We can tell you which mechanism covers a specific provider on request — write to support@rentbear.co, and we will also send you the current location of the data it holds.
4. Changes to This List
Before a new subprocessor starts handling personal data, we will update this page. Where the change is material we will give at least 30 days notice, so that anyone who objects has time to raise it or to close their account. To be told when this page changes, email support@rentbear.co and ask to be added to the notification list.
5. Security
Every provider above is selected in part on its security posture, and each is contractually required to apply appropriate technical and organisational measures under Article 32 of the GDPR. On our side, personal data is encrypted in transit, access is limited to the people who need it to do their job, and payment card data never reaches our systems at all.
6. If You Are a Business Customer
If you need a signed data processing agreement, a record of the transfer mechanisms, or a copy of our security documentation, write to support@rentbear.co and we will arrange it.
7. Contact
Questions about anything on this page go to support@rentbear.co. Your rights over this data — access, correction, deletion, portability and the rest — are set out in section 8 of the Privacy Policy.