Sub-Processor List
Last Updated: May 2, 2026
QRCodeKey engages the third-party service providers listed below ("Sub-Processors") to help us operate the service. Each Sub-Processor receives only the personal data necessary to perform its function, is bound by a written Data Processing Agreement (DPA), and is contractually required to maintain at least the same level of data protection that we provide.
This page is published in support of our obligations under GDPR Article 28(2), the CCPA/CPRA service-provider regime, the India DPDP Act, 2023 Section 8(2), and most enterprise B2B Data Processing Agreements. We will provide reasonable advance notice via email or by updating this page before adding or replacing a Sub-Processor that processes personal data.
Active Sub-Processors
| Sub-Processor | Purpose | Data Processed | Location | Safeguards |
|---|---|---|---|---|
| Firebase Cloud Messaging (Google LLC) | Mobile and web push notifications | Device push token, notification payload | United States (global edge cache) | DPA, EU-US Data Privacy Framework |
| Google Maps Platform | Map display, geocoding, address autocomplete | IP, approximate location, search query | United States | DPA, EU-US Data Privacy Framework |
| MongoDB Atlas | Encrypted cloud database — primary data store | All user data (encrypted at rest) | United States (AWS region) | DPA, ISO 27001, SOC 2 Type II, AES-256 encryption |
| OpenAI, L.L.C. | Powers the "AG" AI chatbot assistant | User chat messages and recent conversation context | United States | DPA, API data is not used to train OpenAI models, 30-day retention for abuse monitoring |
| Render Services, Inc. | Backend hosting and infrastructure | Server logs, request data, session metadata | United States | DPA, SOC 2 Type II, encrypted volumes |
| SendGrid (Twilio Inc.) | Transactional emails (account, billing, notifications) | Email address, name, message content | United States | DPA, SOC 2, ISO 27001 |
| Stripe, Inc. | Subscription billing and payment processing (USD) | Billing address, last 4 of card, transaction metadata. Full card details handled by Stripe — never stored by us. | United States | DPA, PCI-DSS Level 1, SOC 1 & 2 |
| Telnyx LLC | SMS / OTP delivery and account verification (US + international) | Phone number, OTP code, message content, delivery metadata | United States (HQ Chicago, IL) and global SMS routing | DPA, ISO 27001, SOC 2 Type II, HIPAA-aligned |
| Vercel Inc. | Frontend hosting and edge delivery | IP, user agent, request logs | United States and global edge network | DPA, SOC 2 Type II |
Planned Sub-Processors (not yet active)
The following sub-processors will be engaged when we launch the service in additional jurisdictions. They are not currently processing any personal data.
| Sub-Processor | Purpose | Location | Status |
|---|---|---|---|
| Razorpay Software Pvt. Ltd. | Payment processing in INR (planned for India launch) | India | Planned — activates with India launch |
| Fast2SMS | SMS / OTP delivery in India (planned) | India | Planned — activates with India launch |
Change Notification & Objection
For B2B / enterprise customers operating under a Data Processing Agreement, we will provide at least 14 days' advance notice via email or this page before engaging a new Sub-Processor that will process customer personal data. Customers may object to a new Sub-Processor on reasonable data-protection grounds; if we cannot resolve the objection, the customer may terminate the affected service component without penalty.
To subscribe to Sub-Processor change notifications, email privacy@qrcodekey.com with subject "Subscribe to Sub-Processor Updates".
Contact
Company: QRCodeKey by Jal Technology LLC
Address: 647 Rose Ln, Bartlett, IL 60103, USA
Email: privacy@qrcodekey.com
Phone: (708) 300-5490