Sub-processors
Effective: May 17, 2026
What this is
A sub-processor is a third party that processes personal data on Fleetiqo's behalf. This list is maintained for transparency and to support customers who are subject to GDPR Article 28 obligations (where Fleetiqo acts as their data processor). Fleetiqo, LLC is a US-based company; we publish this list voluntarily so that any customer — US, EU, or elsewhere — can see exactly who touches their data.
The standard Data Processing Addendum we sign with B2B customers references this page as Annex II, so it stays current automatically as we add or remove providers.
Where Fleetiqo itself processes data
| Provider | Location | Data categories | Purpose |
|---|---|---|---|
| Hostinger (Main Fleetiqo Server) | United States | All customer-facing personal data (canonical store) | Web hosting + MySQL database |
| Hostinger (GPS Tracking Server) | United States | Vehicle GPS coordinates, trip history | Traccar GPS server + GPS database |
| GitHub | United States | Encrypted nightly DB backups (gpg-encrypted, no plaintext PII) | Off-site backup storage |
The Main Fleetiqo Server (Hostinger US data center) holds the canonical copy of every customer record. The GPS Tracking Server is also Hostinger US. The GitHub backup repository is private and stores only gpg-encrypted archives.
Active sub-processors
| Provider | Location | Data categories | Purpose |
|---|---|---|---|
| Stripe, Inc. | US / EEA | Name, billing address, card last-4, payment-intent metadata | Subscription billing, marketplace checkout, refund processing |
| Stripe Identity | US / EEA | Driver-license image, name, DOB (booking flow KYC when enabled) | KYC verification for high-value rentals |
| Google LLC — Gmail API | United States | OAuth tokens; Gmail message metadata + body for from:noreply@mail.turo.com only | Turo rental email sync via Pub/Sub |
| Microsoft Corporation — Graph API | US / EEA | OAuth tokens; Outlook message metadata + body for Turo notification filters | Turo rental email sync via Graph push |
| Resend | United States | Subscriber email + name + opt-in status | Outbound booking-campaign emails (newsletters only) |
| Customer-supplied SMTP (e.g. Gmail, Postmark) | Customer-controlled | Recipient address, transactional email body | Transactional email — sent through each customer's own SMTP credentials; Fleetiqo doesn't aggregate or relay through a shared provider |
| Cloudflare R2 | EU / US | Driver-license images, vehicle photos, support attachments | Object storage with proxied public access |
| Tesla, Inc. — Fleet API | United States | VIN, telemetry, charge state (only for Tesla owners who explicitly connect their account) | Live charge / lock / location for connected Teslas |
| Apple Inc. — App Store / Sign in with Apple | United States | Apple ID, email (Hide-My-Email relay if user opted), device tokens | iOS app distribution + OAuth |
| Google LLC — Play Store / Google Sign-In | United States | Google account email, IAP receipt tokens | Android app distribution + OAuth |
| Hostinger DNS | Lithuania / EU | Domain DNS records (no end-user data) | DNS hosting |
What's NOT a sub-processor
These appear in our codebase but don't touch identified personal data:
- Nominatim (address autocomplete) — only the partial query string the user types is sent, never bound to an identity.
- status.stripe.com— Stripe's public health feed, no auth, no PII.
- Google Analytics — gated behind the cookie-consent banner; never loaded for visitors who reject analytics, and IP-anonymized when it is. See the Cookie Policy.
Notification of changes
We notify customers on the public-DPA list at least 30 days before adding or materially changing a sub-processor — that satisfies the right of objection under Art. 28(2). Notice is sent by email to the address on each customer's account; you may object on reasonable grounds, in which case we will work in good faith to address your concerns or, failing that, you may terminate the affected service without penalty for the remainder of the current term.
The "Effective" date at the top of this page bumps on every material change. A copy of any prior version is available from privacy@fleetiqo.com on request.
Contact
Questions, objections, or requests for a copy of the signed sub-processor agreements → privacy@fleetiqo.com.
Get told before this list changes
We give at least 30 days’ notice before a new sub-processor starts processing customer data. Add your address and we’ll email you when it does — useful if you have to keep a vendor register up to date.
Prefer a feed? Our site feed carries the same announcements. Signed DPAs and security questionnaires: legal@fleetiqo.com.
What changed
May 17, 2026
First published.
Full version history for every Fleetiqo policy. Need a signed copy of a superseded version for a procurement file? Email legal@fleetiqo.com quoting the document and the date.
Sub-processors — Fleetiqo, LLC. Version of May 17, 2026.
Canonical version: https://fleetiqo.com/sub-processors · Version history: https://fleetiqo.com/legal/versions