Legal Draft
Sub-processors
Draft — under review, not yet in effect.
Draft — under review, not yet in effect
This is a working draft of the Yardstick Sub-processors page. It has not been reviewed or approved by a lawyer, it is not legal advice, and nothing on this page is in effect until this notice is removed and a final version is published. Highlighted brackets are open items that still have to be decided or confirmed.
[OWNER REQUIRED] a fact only the owner can supply (set once in site.config.json)[OWNER DECISION] a business decision or fact to confirm[COUNSEL REVIEW] a question for counsel[suggested] a proposed value
Version 1.0-draft, effective on the date this page is published: [OWNER REQUIRED: effectiveDate, set to the publication date when this version is published]
Audited against the code and configuration: 2026-10-12 (yardstick-saas render.yaml, .env.example, src/config-check.js, the page CSP and script tags; getyardstick-site netlify.toml). Provider links were checked on 2026-10-12. Processing regions aren't recorded in the code or configuration, so each is marked OWNER VERIFY until it's confirmed from the provider's account settings or contract.
About this list
These are the third parties that process personal information for Yardstick Rental Software LLC ("Yardstick") to provide the Service. Before adding or replacing one that processes Customer Personal Data in a material way, we'll update this page and tell business customers as the Data Processing Addendum describes. Status: In use means it processes data in production today; When enabled means it's used only once a feature is switched on for the Service or by a business.
Sub-processors
| Provider | Purpose | Personal data involved | Region | Status | Privacy policy / DPA |
|---|---|---|---|---|---|
| Render Services, Inc. | Hosts the Yardstick app and its PostgreSQL database, including stored photos | All Service data | [OWNER VERIFY: Render region of the app and database] | In use | Privacy · DPA |
| Stripe, Inc. (Billing) | Billing for Yardstick subscriptions | Business billing contact and payment details (card details are held by Stripe; Yardstick stores customer and subscription IDs, plan and status) | [OWNER VERIFY] | In use | Privacy · DPA |
| Stripe, Inc. (Stripe Identity) | Renter identity verification | The renter's ID images, selfie and the biometric match, held and processed by Stripe; Yardstick receives the status and verified name | [OWNER VERIFY] | When enabled (Stripe Identity configured for the Service, and the business turns verification on) | Privacy · DPA |
| Anthropic, PBC | AI Damage Check; AI Help; photo suggestions for new equipment | Pickup and return condition photos and equipment names; Help questions, up to 8 earlier messages, app page, user role and minimal account facts (no renter names, contact details, booking details or amounts); equipment names and categories | [OWNER VERIFY] | In use (each business can turn automatic damage checks off) | Commercial Terms · DPA · Privacy |
| Resend (Plus Five Five, Inc.) | Sending email, from noreply@getyardstick.co | Recipient names and email addresses; email content (rental details and secure links); the business's contact email as the reply-to on renter emails | [OWNER VERIFY] | In use | Privacy · DPA |
| Google LLC (Google Fonts) | Web fonts on the business app and renter pages | IP address and browser information of anyone who loads those pages | [OWNER VERIFY] | In use | Privacy |
| Google LLC (Google Maps Platform: Places and Address Validation) | Suggesting and checking business location addresses typed by business users; requests go from Yardstick's server, not the user's browser | The address text being typed or checked (business locations, not renter data) | [OWNER VERIFY] | When enabled (ADDRESS_PROVIDER=google); off in production today | Privacy · [OWNER VERIFY: the Google Maps Platform data-protection terms that apply to the account] |
| Netlify, Inc. | Hosts this marketing site, getyardstick.co, including the demo-request page (the form itself posts to the Yardstick app) | Site visitors' IP address and browser information | [OWNER VERIFY] | In use [OWNER VERIFY: confirm production is deployed on Netlify; the repository is configured for it] | Privacy · DPA (PDF) |
[OWNER VERIFY: Cloudflare. Nothing in the code or configuration uses Cloudflare. If it provides DNS only, it receives no personal data from the Service and isn't listed. If it proxies traffic to the app or this site, add it to the table, since it would receive IP addresses and request information.] Cloudflare's policies, for reference: Privacy · DPA.
Services a business or user chooses to connect
These receive data only when a business or user connects them, and act under their own terms and privacy policies.
| Provider | Purpose | Data sent or received | Trigger | Status | Privacy policy |
|---|---|---|---|---|---|
| Google LLC (Sign in with Google) | Optional sign-in for business users | Google account ID, email and name are received from Google | A user chooses Google sign-in | When enabled (built, switched off today) | Privacy |
| Intuit Inc. (QuickBooks Online) | Accounting sync | Renter's name (as the customer), invoice line descriptions and amounts | A business connects QuickBooks and syncs an invoice | When a business connects it | Privacy |
| Xero Limited | Accounting sync | Renter's name (as the contact), invoice line descriptions and amounts | A business connects Xero and syncs an invoice | When a business connects it | Privacy |
Loaded on renter pages, not processing payments
| Provider | What happens | Note |
|---|---|---|
| Stripe, Inc. (Stripe.js) | Stripe's script loads on the booking page and the Manage Rental page and may set Stripe cookies and collect device information for fraud prevention | Renter card payments aren't offered today. Stripe Connect (renter payments to the business's own Stripe account) will be added to the table above, with notice, before renter payments are ever turned on. |
Not used
Yardstick doesn't currently use any analytics, advertising-pixel, session-recording, SMS, error-tracking or support-chat provider. If that changes, this list and the Privacy Policy will be updated first.
Questions
Questions about this list, or to object to a new sub-processor: privacy@getyardstick.co.