Subprocessors
The companies that process data on our behalf, what each one does, and what it touches.
Version 0.1 · In effect August 25, 2026
Who processes data for us
| Provider | What it does for us | What it touches |
|---|---|---|
| Supabase | Database, authentication and file storage. The product's whole record lives here. | Account details, BIR profiles, orders, invoices, buyer fields, encrypted marketplace tokens |
| Vercel | Runs the web application and serves it. | Request data and server logs, which can include an account identifier |
| Resend | Sends transactional email, and holds the marketing contact list for people who opted in. | Name and email address |
Each of these is bound to process data only on our instructions, to keep it confidential, and to apply security measures consistent with the Data Privacy Act.
Where data comes from, and where it goes
These are not subprocessors. They are the marketplaces you authorise us to read, and the authority an invoice is transmitted to, and the relationship is a different one.
| Party | Relationship |
|---|---|
| Shopee | Source. Read only, within the scope your consent grants, and only until you withdraw it |
| TikTok Shop | Source, on the same terms |
| Lazada | Source, on the same terms |
| Bureau of Internal Revenue | Recipient. Invoices are transmitted to its Electronic Invoicing System, which is the purpose of the product |
Changes to this list
This page carries a version and a date at the top, and it is updated when the list changes rather than at a review cycle. If you hold a written agreement with us that requires notice before we add a provider, that agreement governs.