Legal
Sub-processors
Last updated: 2 October 2026
A sub-processor is a third party we use to process personal data on behalf of our customers: the employee and workforce data venues enter into Suparota. Each sub-processor is bound by a written contract with data protection obligations materially equivalent to those in our Data Processing Agreement.
We will update this page at least 14 days before engaging a new sub-processor or replacing an existing one, and notify subscribers by email.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Supabase (Supabase, Inc.) | Database hosting and server-side functions | All employee and workforce data entered into the platform | Data stored in the EU (Paris, France) |
| Clerk (Clerk, Inc.) | Sign-in, user accounts and organisation membership | Names, email addresses, organisation membership, sign-in and session data | United States |
| Vercel (Vercel, Inc.) | Hosting the app and delivering it to devices | Technical request data (such as IP address and pages requested); no workforce data is stored | United States, with a global delivery network |
| Resend (Resend, Inc.) | Sending email (invitations, notifications, shift reminders) | Recipient names and email addresses, and email content | United States (email is sent from EU infrastructure in Ireland) |
| Twilio (Twilio, Inc.) | Sending WhatsApp notifications, where a venue enables them | Recipient names and WhatsApp numbers, and message content (shift dates, times and manager notes; no pay information). WhatsApp messages are delivered through WhatsApp, operated by Meta | United States |
| Anthropic (Anthropic Ireland, Limited) | Powering Supe AI, our built-in AI assistant | Workforce data needed to answer a request, which can include names, contracted hours, shift and holiday dates, and pay information; and, during onboarding, a short sample of an uploaded staff spreadsheet. Sickness records are not sent. Anthropic's terms do not allow it to train its models on this data | United States |
International transfers
Where a sub-processor processes personal data outside the UK, or is a US company that may access data stored in the EU, we rely on a mechanism recognised by UK data protection law: the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or otherwise the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Details for each provider are available on request at support@suparota.com.
Other service providers
These providers process data for which Suparota is the controller, not data we process for our customers, so they are not sub-processors. We list them for transparency:
| Provider | Purpose | Location |
|---|---|---|
| Stripe (Stripe Payments Europe, Limited and Stripe Payments UK Ltd) | Subscription billing for venue operators. Card details are collected and held by Stripe; Suparota never sees them | Ireland and United Kingdom (Stripe may also process data in the United States) |
| PostHog (PostHog, Inc.) | Analytics on our marketing website, suparota.com. Not used in the Suparota app | EU |
Previous versions
This is the first version of this page.