Sub-processors
Last updated: September 6, 2026
A sub-processor is any third-party company we rely on to help deliver the Services - for example, the provider that hosts our database, or the service that sends a transactional email on your behalf. Each sub-processor only receives the data it needs to do that specific job, under a written agreement that requires it to protect that data and use it for no other purpose. Below is the complete, current list.
1. Current sub-processors
| provider | what it does | where it processes |
|---|---|---|
| Supabase | database, authentication, file storage | EU (eu-north-1) |
| Vercel | website hosting and delivery | global edge |
| Resend | transactional email (orders, ticket OTP) | US |
| Anthropic | the Kubi AI assistant | US |
| OpenStreetMap Foundation | Address autocomplete at checkout. What a buyer types into the checkout address field is sent to this service to fetch suggestions. | EU |
This is the same list, kept in one place, that appears in section 5.1 of our Privacy Policy. We will update it here before adding, removing, or changing a sub-processor.
2. Requesting a signed DPA
If your company needs a signed Data Processing Agreement (DPA) covering this sub-processor list - for example, as part of your own GDPR or vendor-security due diligence - email [email protected] and we'll send our DPA template for your legal team to review and countersign.