Subprocessors
Last updated: [DATE].
MyTradeCrate engages the third-party service providers ("Subprocessors") listed below to deliver the Service. Each Subprocessor is bound by a written data-processing agreement that restricts its use of Personal Data to the purposes of providing services to MyTradeCrate and obligates the Subprocessor to implement and maintain appropriate technical and organizational security measures. This page is incorporated into our DPA.
| Subprocessor | Purpose | Location | Data handled |
|---|---|---|---|
| Supabase, Inc. | Database, authentication, file storage | US (AWS us-east-1) | All Customer Content |
| Vercel, Inc. | Web hosting, edge compute | US + global edge | Request metadata, logs (no Customer Content persisted at rest) |
| Stripe, Inc. | Subscription billing + payment processing for end customers | US | Account email, business name, payment metadata. Card data never touches MyTradeCrate. |
| Resend, Inc. | Transactional email delivery | US | Recipient email, subject, message body, delivery status |
| Telnyx LLC | SMS delivery | US | Recipient phone number, message body, delivery status |
| Google LLC (optional) | OAuth, Drive file storage, Maps | US | Only when you opt in. Drive: invoice/estimate/receipt files you choose to back up. Maps: property addresses you measure. |
| Intuit Inc. (optional) | QuickBooks Online sync | US | Only when you opt in. Customers and invoices you choose to push. |
| Functional Software, Inc. (Sentry, optional) | Error monitoring | US/EU | Anonymized stack traces and breadcrumbs. PII is filtered server-side. |
| UptimeRobot (optional) | Public endpoint monitoring | US | Public URLs only. No Customer Content. |
Adding or Changing Subprocessors
MyTradeCrate will notify Customers at least thirty (30) days before engaging a new Subprocessor that will process Personal Data, by updating this page and providing email or in-app notice. Customers may object on reasonable, documented data-protection grounds as described in our DPA. To subscribe to subprocessor notifications, email [PRIVACY EMAIL] with subject "Subprocessor notifications".
Customer-Controlled Subprocessors
Optional integrations marked above (Google, Intuit, Sentry, UptimeRobot) only process Personal Data when you opt in by connecting them in Settings → Integrations. Disabling an optional Subprocessor disables the corresponding feature but does not affect the core Service.
Backups
Encrypted off-site database backups are written weekly to Backblaze, Inc. (Backblaze B2 storage, located in the United States) under a written data-processing agreement. Backups are retained on a twelve (12) week rolling schedule with first-of-month snapshots retained indefinitely; each backup is AES-256-CBC encrypted with a key held only by MyTradeCrate.