Subprocessors
The companies that process data on our behalf, what each one does, and what it touches.
Version 0.2 · In effect October 1, 2026
Who processes data for us
| Provider | What it does for us | What it touches |
|---|---|---|
| Supabase | Database, authentication and file storage. The product's whole record lives here. | Account details, Business Profiles, orders, invoices, buyer fields, encrypted marketplace tokens |
| Vercel | Runs the web application and serves it. | Request data and server logs, which can include an account identifier |
| Resend | Sends transactional email, and holds the marketing contact list for people who opted in. | Name and email address |
Each of these is bound to process data only on our instructions, to keep it confidential, and to apply security measures consistent with the Data Privacy Act.
Where data comes from, and where it goes
These are not subprocessors. They are the marketplaces you authorise us to read, the sign-in providers you can choose instead of a password, and the authority an invoice is transmitted to, and the relationship is a different one.
| Party | Relationship |
|---|---|
| Shopee | Source. Read only, within the scope your consent grants, and only until you withdraw it |
| TikTok Shop | Source, on the same terms |
| Lazada | Source, on the same terms |
| Source, only if you choose to sign in with Google. It confirms who you are and sends us your name, email address and profile picture link. It sees nothing held in Resibo | |
| Meta (Facebook) | Source, only if you choose to sign in with Facebook, on the same terms as Google |
| Bureau of Internal Revenue | Recipient. Invoices are transmitted to its Electronic Invoicing System, which is the purpose of the product |
Changes to this list
This page carries a version and a date at the top, and it is updated when the list changes rather than at a review cycle. If you hold a written agreement with us that requires notice before we add a provider, that agreement governs.