In short
Two providers handle the deal data you upload: Supabase and Vercel.
Three more work for us and never receive that data.
We email your account owner at least 30 days before we add or replace a provider in part A. This list changes on the same day.
Part A: sub-processors (they handle the deal data you upload)
| Provider | What it does for us | Which of your data | Where | The company we contract with | Transfer tool |
|---|---|---|---|---|---|
| Supabase | The database. It stores your uploads, your firm, your sign-ins, the record of your tick, the log and our note that your plan is ready | Every field in Annex A of the data agreement; your firm's name; your team's sign-in email addresses; the counts and the tier in our note that your plan is ready | Frankfurt, Germany. Its daily backups are kept for 7 days | Supabase Pte. Ltd., Singapore. Supabase, Inc., US, gives support | The EU's standard contractual clauses, with the UK addendum |
| Vercel | It runs the app. Your upload passes through it on the way to the database, and it builds your pages | The same fields, in passing: it stores none of them. Its request logs hold IP addresses, times and page addresses. A private link is a page address, so the logs hold it | Its functions run in Frankfurt, Germany. Static files and logs are on its worldwide network | Vercel Inc., US. Its data agreement covers our plan | The EU–US Data Privacy Framework with its UK Extension; else the standard contractual clauses |
Each of them uses providers of its own, such as Amazon Web Services for Supabase. Each publishes its own list. Ask us and we send you the current one.
Supabase offers AI helpers in its own dashboard. We never use them on your data.
Part B: other providers (they never receive the deal data you upload)
| Provider | What it does for us | What it holds | The company we contract with, and where | Transfer tool |
|---|---|---|---|---|
| Microsoft | Our mailboxes | Our emails with you, the one that carries your private link among them | Microsoft Ireland Operations Limited. Our mailboxes are in the EU | The standard contractual clauses, with the UK addendum |
| SmartLead | It sends our first emails. If you replied to one, the thread sits there | Your name, your work email address, your firm and that thread, with your private link if we sent it there | 521 Products Pty Ltd, Australia. It stores data in Australia and may process it in other countries | The standard contractual clauses, with the UK addendum |
| Slack | Our own alerts: you replied, or a plan is ready | Your firm's name and the answer we drafted, with the estimate from your two numbers and your private upload link. Counts, your tier, our own reference for the person we sent the link to, and the link to your plan. Never your name or your address. Never a company or a person from your deal data | Slack Technologies Limited, Ireland. It stores data in the US | The standard contractual clauses, with the UK addendum |
Two more providers help us find firms to write to and check email addresses. They never receive your deal data. Our main privacy notice names them.
A private link opens your plan until its data is deleted. So a provider that holds the link holds a key to your plan, though it never receives the deals. That is why this list says who holds it.
If a provider in part B ever needs to handle your deal data, it moves to part A first, with 30 days' notice.
Sign-in is not open yet. Before it opens, we add the provider that sends sign-in emails to this list, with its company, its country and its transfer tool.
How we tell you about a change
We email the account owner at least 30 days before a new provider in part A starts. If your firm has no account yet, we email the address we sent your private link to.
The email names the provider, what it will do, where it is, and the transfer tool.
You may object within those 30 days, as section 7 of the data agreement says.
Each version of this list carries its date. We keep the earlier versions.