Subprocessors
Last updated July 3, 2026
To deliver the Service, Handfelt relies on a small number of third-party vendors (“subprocessors”) that may process personal information on our behalf under contractual restrictions. This page lists those vendors and what each one accesses. It supplements our Privacy Policy and Terms of Service.
Current subprocessors
| Vendor | Service | Data accessed | Purpose |
|---|---|---|---|
| Handwriting rendering service | Generates handwriting and addresses | Message templates and per-recipient merge fields (e.g., name, custom fields), and the destination address | Render each piece into printable images |
| Print & mail-fulfillment vendor | Prints pieces and tenders them to USPS | Recipient name and full mailing address, and the rendered piece | Print, assemble, and mail your Campaign |
| Stripe | Payment processing | Billing name, email, billing address, and payment method (we do not store full card numbers) | Process Credit purchases, subscriptions, invoices, and refunds |
| Resend | Transactional email | Email address | Send sign-in links and account notifications (no marketing) |
| Cloudflare R2 | Cloud object storage | Rendered piece images and related files | Temporarily store rendered output during production |
| Hosting & analytics (Vercel) | Website/app hosting and privacy-friendly traffic analytics | Request and aggregate usage data; analytics does not identify you individually | Operate the website and portal and understand aggregate usage |
Data processing agreement (DPA)
Where Handfelt processes Recipient Data on your behalf, we act as your processor. If you are subject to the GDPR, CCPA, or similar laws and need a data processing agreement, email support@handfelt.cowith “DPA Request” in the subject line. You remain responsible for having a lawful basis and any required consent to provide Recipient Data and to mail your Recipients.
Sub-subprocessors
Some subprocessors engage their own vendors (for example, Stripe’s banking partners or a hosting provider’s infrastructure). Those vendors are governed by the subprocessor’s own agreements and policies.
Changes to this list
We may add or replace subprocessors as the Service evolves. Where required, we will provide advance notice (we aim for at least 30 days) by updating this page or notifying you. If you have a data processing agreement with us and reasonably object to a new subprocessor, you may contact us to discuss alternatives or, if we cannot resolve it, terminate the affected Service. Emergency changes (for example, a vendor ceasing operations) may take effect with shorter notice.
Security and confidentiality
Our agreements with subprocessors require them to protect information with appropriate safeguards, to use it only to provide their services to us, and to keep it confidential.
Contact
Questions about our subprocessors or a DPA? Email support@handfelt.co.