1.Current subprocessors
| Provider | Purpose | Data it receives |
|---|---|---|
| Supabase | Database, authentication and private file storage | All account and order data; sign-in credentials; proof photos and signatures (private bucket). Region: [hosting region] |
| Vercel | Application hosting and serverless functions | Every request to the site and app passes through it; server logs |
| Resend | Sending email | Recipient email address, the message text and the business’s name and reply-to address |
| Twilio | Sending texts, delivery receipts, carrier registration | Recipient phone number and message text; the business’s registration details (legal name, EIN, address, website) |
| Stripe | Subscription billing | Account owner’s name and email; card details go to Stripe directly and never reach our servers |
| Nominatim (OpenStreetMap) | Turning addresses into map coordinates | The address text of orders, depots and zone centres (no names) |
| OSRM | Road distances and drive times between stops | Coordinates only — no addresses or names |
| OpenFreeMap | Map tiles drawn in the browser | The viewer’s IP address and the map area being viewed, requested by their browser |
| Google Maps Platform | Geocoding, road distances and maps — only for businesses that enable it | Address text and coordinates; the viewer’s IP address for maps in the browser |
Web analytics on the marketing site, if enabled: [analytics provider and what it receives]. Tracking pages, driver links and the office app carry no analytics.
2.How we tell you about changes
- We update this page and its “last updated” date whenever a provider is added, replaced or removed.
- Businesses with a signed data processing addendum receive notice at least [subprocessor notice period] before a new subprocessor handles their data, and may object on reasonable data-protection grounds.
- Not subprocessors: the carriers that deliver texts are engaged by Twilio, not by us; OpenStreetMap itself is a data source, not a processor.