Sub-processors

To run tradescraft.app we rely on a small set of trusted service providers (“sub-processors”) that may handle personal information on our behalf. Each is bound by contract to handle data in line with our obligations under the Australian Privacy Principles, the New Zealand Information Privacy Principles, and the GDPR where it applies. We don't sell your data and we never share it with advertising platforms.

Current sub-processors

• Supabase - Database, authentication, file storage and secret vault. Data region: Japan - a single fixed region outside Australia and New Zealand.
• Stripe - Card-payment processing for the invoices your customers pay. Data region: United States (global processing).
• Xero - Two-way accounting sync - only if you connect it. Data region: Australia / New Zealand.
• Resend - Transactional email (notifications, invitations, invoice reminders). Data region: United States.
• Twilio - Customer-facing SMS, when your plan includes it. Data region: United States (global delivery).
• Vercel - Web application hosting and content-delivery network. Data region: Global edge network.

Where your operational data lives

Your operational data and uploaded files - clients, jobs, quotes, invoices, time, materials, safety paperwork and documents - are stored with Supabase in a single fixed region outside Australia and New Zealand (Japan); see the privacy policy for the cross-border disclosure detail under Australian Privacy Principle 8 and NZ IPP 12. Each business is isolated at the database, so another business cannot read your records. See the security page for how that isolation is enforced, and the privacy policy for the full detail on cross-border disclosure.

Changes to this list

If we add or change a sub-processor that handles personal information, we'll update this page and its “last reviewed” date. Material changes are notified to everyone with an active account by email before they take effect. Questions: privacy@tradescraft.app.