Sub-processors

To run tradescraft.app we rely on a small set of trusted service providers (“sub-processors”) that may handle personal information on our behalf. Each is bound by contract to handle data in line with our obligations under the Australian Privacy Principles, the New Zealand Information Privacy Principles, and the GDPR where it applies. We don't sell your data and we never share it with advertising platforms.

Current sub-processors

• Supabase - Database, authentication, file storage and secret vault. Data region: Japan - a single fixed region outside Australia and New Zealand.
• Stripe - Card-payment processing for the invoices your customers pay. Data region: United States (global processing).
• Xero - Two-way accounting sync - only if you connect it. Data region: United States (Xero's hosting), with some processing in New Zealand.
• Resend - Transactional email (notifications, invitations, invoice reminders). Data region: United States.
• Twilio - Customer-facing SMS - a planned add-on that is not yet live, so no messages are sent through it today. Data region: United States (global delivery).
• Vercel - Web application hosting and content-delivery network. Data region: Global edge network.
• Photon (komoot GmbH) - Address search and geocoding - turns the addresses you type into map coordinates. Receives the address text and coordinates you enter for sites and jobs. Data region: European Union (Germany).
• OSRM (Open Source Routing Machine) - Driving-distance and route estimates between your base and a site, for travel lines and dispatch. Receives site and job coordinates. Data region: European Union.
• OpenFreeMap - Serves the base map tiles the operations map is drawn from. Receives your device's IP address and the map area being viewed. Data region: Global (open map-tile service).

Where your operational data lives

Your operational data and uploaded files - customers, jobs, quotes, invoices, time, materials, safety paperwork and documents - are stored with Supabase in a single fixed region outside Australia and New Zealand (Japan) - a cross-border disclosure under Australian Privacy Principle 8 and NZ IPP 12. Each business is isolated at the database, so another business cannot read your records. See the security page for how that isolation is enforced, and the privacy policy for the full detail on cross-border disclosure.

Changes to this list

If we add or change a sub-processor that handles personal information, we'll update this page and its “last reviewed” date. Material changes are notified to everyone with an active account by email before they take effect. Questions: privacy@tradescraft.app.