Provider: Raynux Pty Ltd (ABN 38 700 717 166), Level 29, 221 St Georges Terrace, Perth WA 6000, Australia. Version 1.0. Last updated: 30 September 2026.
This list covers the third parties (sub-processors) that process personal data to help Raynux Pty Ltd provide Librarika, and the countries in which they operate. It supports our Privacy Policy, GDPR Statement and Data Processing Agreement (DPA): the policies state the categories of recipient and our transfer safeguards, and this list carries the current detail, so we can add or change a sub-processor without re-issuing those documents. We give at least 30 days' notice before a new sub-processor begins processing and a reasonable opportunity to object, as our DPA requires; we may give this notice generally (for example through the Service or on this page) rather than by individual email. The current list is published on this page, and we post any changes here.
| Sub-processor | Purpose | Location(s) |
|---|---|---|
| DigitalOcean | Cloud hosting and infrastructure (application and database hosting, storage and delivery) | Netherlands (Amsterdam) |
| Rackspace | Object/file storage for files uploaded by libraries and patrons (e.g. cover images, attachments) | United Kingdom |
| Paddle | Payment processing and subscription billing (merchant of record). Additional/alternative payment provider that may be engaged; approved but not yet active. Librarika receives only tokenised references, not card data. | United Kingdom |
| FastSpring | Payment processing and subscription billing (merchant of record); Librarika receives only tokenised references, not card data. | United States |
| Stripe | Payment processing and subscription billing. Additional/alternative payment provider that may be engaged; approved but not yet active. Librarika receives only tokenised references, not card data. | United States |
| Mailgun | Transactional and notification email delivery (e.g. password resets, alerts, reminders) | Global (US / EU) |
| Google LLC — sign-in & anti-abuse | Google sign-in (OAuth) for users who choose it, and reCAPTCHA anti-abuse checks | United States / global |
| Google LLC — analytics | Google Analytics (web usage analytics) and Firebase (mobile app analytics, push notifications and crash reporting) | United States / global |
| Sentry | Application error and crash diagnostics | United States |
| Google Workspace | Business email and handling of support correspondence | Global (EU data region configurable) |
| Atlassian Jira | Internal development, task and issue tracking (and, in future, support-ticket management). Personal data may appear where it is included in bug reports, diagnostics or tickets. | Global (Atlassian default region) |
| Ollama Cloud | Limited AI assistance used only to help draft replies to support emails, always under human review; applied to support-message content, not the bulk of customer or patron data | United States (default) |
| Software development & customer-support contractor | Development, maintenance and customer support, with access to production data under confidentiality, security and data-protection terms and the Standard Contractual Clauses | Bangladesh |
Scope
This list covers providers that process personal data in delivering Librarika. Internal engineering and documentation tools that do not process patron or customer personal data — for example, source-code hosting (Bitbucket, GitHub) and domain/registrar and certificate providers — are not listed. We also query public bibliographic sources (such as Open Library and ISBNdb) to enrich catalogue records; these receive only public search terms, not personal data.
Transfers
Where a transfer is to a country without an EU/UK adequacy decision, we rely on the European Commission's Standard Contractual Clauses (2021) and, for UK data, the UK International Data Transfer Addendum, together with a transfer risk assessment and additional technical and organisational measures. Payment providers act as merchant of record and process buyers' payment details directly; Librarika does not receive or store card data.
Notes
"Location" is where the sub-processor primarily stores or accesses personal data; some providers may process data in additional countries. Some sub-processors listed may be approved but not yet active; they are included here in advance of engagement so that their later activation does not require a further change notice. Questions about our sub-processors, or to request notice of changes: info@raynux.com.