1. Our sub-processors
These providers handle personal data for us when we deliver the Service. Each is bound by a written agreement that requires the data protection obligations in our Data Processing Addendum.
| Provider | What it does for us | Data involved | Location |
|---|---|---|---|
| Supabase | Database, sign-in and file storage | Account details, practice and brand details, contacts, campaigns, booking requests, uploaded files | [Supabase project region] |
| Vercel | Application hosting and content delivery | Everything that passes through the website and app while a page is served; request logs | United States, with a global edge network |
| Elastic Email | Delivering campaign email, tracking delivery and handling unsubscribes | Contact names and email addresses, email content, delivery, open, click, bounce and unsubscribe events | Canada, with processing in the United States and the European Union |
| Resend | Account and notification email (verification links, booking request alerts) | Recipient email address and the message | United States |
| Stripe | Payments and billing | Billing contact, payment details (entered with Stripe, never stored by us), purchase history | United States, with a global network |
| OpenAI | Writing campaign copy and generating images | Campaign brief, practice details such as name, services and offers. Not your contact list | United States |
| Upstash | Queuing background jobs such as image generation and sending | Job messages that identify the work to be done | [Upstash region] |
| Context.dev | Reading a practice's public website for its brand details | Your website address and the public brand information found there | United States |
| SlackOnly if you connect it | Delivering notifications to your Slack workspace | Notification messages you choose to receive | United States |
| MailchimpOnly if you connect it | Sending through your own Mailchimp account | Campaign content and your Mailchimp audience, as you direct | United States |
2. When this list changes
We will give at least 30 days’ notice before a new or replacement provider starts handling customer personal data. We email the owner of each account and update this page. If you object on reasonable data protection grounds, tell us at support@modularmail.io, as described in the DPA.
3. International transfers
Some providers process data outside Australia, the UK and the European Economic Area. Where that is so, we rely on approved safeguards such as the Standard Contractual Clauses. See section 10 of the DPA.