1. Current subprocessors
| Provider | Purpose | Data location | Transfers outside the EEA | Provider documents |
|---|---|---|---|---|
| Supabase | Database, sign-in, file storage (photos, logos, receipts, PDFs) and live updates | EU – Ireland (AWS eu-west-1) | Data is stored in the EU; access from outside the EU is covered by the EU Standard Contractual Clauses | DPA · Subprocessors · Privacy |
| Vercel | Hosting of the website and the app, server functions | Server functions in the EU – Dublin, Ireland; content delivered through Vercel's global network (Vercel Inc., USA) | EU Standard Contractual Clauses | DPA · Subprocessors · Privacy |
| Stripe | Subscription payments, invoices and VAT calculation; card details go to Stripe only, never to CueLoad | EU and USA | EU-U.S. Data Privacy Framework | Privacy · Privacy Center |
| Resend | Sending account emails (sign-up and password reset codes) | Sending region EU – Ireland (Resend, Inc., USA) | EU-U.S. Data Privacy Framework and EU Standard Contractual Clauses | DPA · Subprocessors |
2. Push notifications
If you turn on push notifications, they are delivered by the push service of your own browser – Google (Chrome, Android), Mozilla (Firefox), Microsoft (Edge, Windows), Apple (Safari, iOS). Your browser chooses the service, not CueLoad. Notifications are encrypted end to end, so the push service cannot read them.
3. Changes to this list
Before we add or replace a subprocessor, we email organization owners and update this page at least 30 days in advance, with a new date and version above. You can object as described in the Data Processing Agreement. Questions: info@cueload.com.