This document is available in English only. The Dutch and Turkish pages of the site link here; a Dutch translation will follow. Questions? Use the contact form.

Sub-processors

Rvply Last updated: 23 October 2026

---

Rvply engages the third parties below to process personal data on behalf of its customers. Each is bound by a data processing agreement that imposes obligations no less protective than those in our own Data Processing Agreement.

We will notify customers at least 30 days before adding or replacing a sub-processor. Customers may object on reasonable data protection grounds within that period.

Current sub-processors

Notes on these

OpenAI. Rvply uses the Responses API to generate draft replies. Requests can include review text, rating and the reviewer's first name; relevant business and language information; configured tone, signature and reply instructions; and recent replies from the same location. The request uses store: false, which disables response storage for later API retrieval. It does not establish Zero Data Retention or exclude separate abuse monitoring and temporary prompt caching. See the Privacy Policy, section 4.3 for the data scope and provider retention explanation, and OpenAI's data controls for its current rules. Requests go to OpenAI's global API endpoint. Rvply does not currently use OpenAI's European data residency, so requests are processed in the United States under the Standard Contractual Clauses in OpenAI's Data Processing Addendum.

Mollie. Payments for Rvply subscriptions are processed by Mollie B.V., a licensed payment institution in Amsterdam. It is listed here because our terms say the payment processor is named on this page, but it is not a sub-processor of your review data: for the payment itself Mollie acts as an independent controller under its own privacy statement. Rvply reads the payment details returned by Mollie and stores payment status and a masked payment-method label showing the last four digits where available.

Google. Google is deliberately not listed here. Your reviews are already held by Google, on your own Business Profile, under your own agreement with them. Rvply reads and writes them using the access you grant; Google is not processing your data on our instructions, so it is not our sub-processor. What that access covers is set out in full in the privacy policy and in Annex I of the Data Processing Agreement.

Revisions

Every change so far was made before the service carried any customer data.

23 October 2026. The public website moved to the Hetzner server in Nuremberg that also runs the application, at rvply.com. Its previous host no longer processes anything for Rvply.

4 October 2026. Mollie named as the payment processor, now that paid plans can be bought online. OpenAI became the provider that drafts replies. No customer data had been sent to an AI provider before that date: the service had not yet drafted a reply for any customer.

5 September 2026. The application moved to Hetzner in Nuremberg, Germany.

24 August 2026. Parties that were planned rather than engaged were removed: Stripe for payments, Cloudflare in front of the application, and Sentry for error monitoring. None of them ever processed anything.

The thirty-day notice above applies to adding or replacing a sub-processor that processes customer data. These revisions were made while there was no customer data to process, so there was nothing to give notice of. They are recorded here because a list that quietly changes is the thing the notice period exists to prevent.

Changes

Material changes to this list are announced by email to the primary contact on each account. The date at the top of this page always reflects the current version.

Questions: info@shipitdigital.nl