Draft — under legal review. Not yet in effect.
Subprocessors
These are the outside services that store or process our Customers’ data on our behalf, for Customers in both the United States and the United Kingdom. The Company remains responsible for them.
| Service | What it does for us | Customer data it holds | Where |
|---|---|---|---|
| Vercel Inc. | Hosts the website and runs the application. Request logs, including IP addresses, pass through its systems. | Everything sent to or shown by the Service, while it is in transit and being processed | United States (application functions in the us-east-1 region) |
| Supabase, Inc. | Hosts the Postgres database where customer records and uploaded files are stored. | All stored customer data: records, uploaded documents and photos, user accounts, sign-in sessions, security events and terms acceptances | United States (AWS us-east-1 region) |
Nothing else
- No other outside service receives Customer data.
- Text in uploaded files and photos is read by Tesseract, open-source software that runs on the Service’s own servers, hosted as above. No outside reading or AI service sees the files.
- The Service sends no email through an outside service. Invite and password links are shown to the Customer’s owner or admin, who passes them on.
- Our source code is kept on GitHub. GitHub does not receive or hold Customer data, so it is not a subprocessor.
- The Service loads no analytics, advertising or tracking services, and its fonts are served from its own address.
Transfers from the United Kingdom
Both subprocessors are in the United States. For UK Customers, transfers to them are covered by the UK International Data Transfer Addendum to the Standard Contractual Clauses, as our Data Processing Addendum and Privacy Policy describe.
Changes to this list
Before a new subprocessor starts handling Customer data, we update this page and email our Customers’ account contacts at least 30 days ahead. A Customer with a reasonable objection can tell us at the Contact page, and we will work with it in good faith; if we cannot resolve it, the Customer may stop using the Service.