Subprocessor & Infrastructure Notice
The provider categories currently used to deliver StaffRooster and how customers are informed of material changes.
Effective October 14, 2026Current infrastructure
| Provider/category | Purpose | Data involved | Location |
|---|---|---|---|
| OpenAI / ChatGPT Sites platform | Application hosting, platform delivery, and AI-enabled service infrastructure | Account, customer content, requests, output, and service telemetry as needed | United States / provider locations |
| Cloudflare infrastructure | Application compute, database storage, networking, security, and delivery | Customer content, account/workspace records, logs, and network data | United States / global network |
| OpenAI API | Generation of requested Rooster drafts and workflow output | Approved prompts, workflow inputs, knowledge context, and generated output | United States / provider locations |
| Stripe | Subscription billing, invoicing, payment processing, tax support, and connected-account onboarding when enabled | Customer, billing, transaction, business-verification, and payment information as applicable | United States / provider locations |
| Resend | Transactional email delivery for form confirmations, account notices, and operational messages | Recipient email address, message content, delivery metadata, and related headers | United States / provider locations |
| Google Workspace / Gmail | Human-approved controlled email delivery and internal testing | Recipient address, approved message content, and delivery metadata | United States / provider locations |
Specific provider entities, regions, and services may depend on the hosting platform’s current architecture and the customer’s configuration. An authorized integration is generally selected by the customer and may act as the customer’s independent provider rather than our subprocessor.
Change notice
We will update this page before or promptly after a material provider change and provide contractual notice where an executed DPA requires it. Customers should use the contact page to establish a notice address before processing regulated personal data.
Flow-down protections
Where a provider processes customer personal data on our behalf, we require contractual confidentiality, security, data-use restrictions, and deletion/return duties appropriate to the service.
Questions or requests?
Use the contact page and choose the closest topic. We may verify your identity before fulfilling a privacy request.