Sub-processors

1.1Each entry names the sub-processor, what it does for the Service, where it processes data, and which data reaches it.

• Supabase (Supabase Inc.) — Database, authentication and file storage. Location: EU (Warsaw, Poland) — the database and all customer data. Data: All Service data
• Vercel Inc. — Hosting of the application and its API. Location: United States (edge network worldwide). Data: Data in transit through the application; server logs
• Resend, Inc. — Transactional email: sign-in links, invitations, notifications. Location: United States. Data: Email address, name, the text of the message
• Paddle.com Market Limited / Paddle.com Inc. — Merchant of record for subscription payments, billing, tax collection and transaction fraud prevention. Location: United Kingdom / United States. Data: Account owner’s name, billing address, email address, transaction history and IP address. No card or banking details reach our servers.
• Telegram Messenger Inc. — Delivery of notifications to staff who linked Telegram; the mini app. Location: United Arab Emirates (servers worldwide). Data: Telegram identifier, the text of the notification
• xAI Corp. — The manager’s assistant in the Telegram bot, when used. Location: United States. Data: The manager’s typed instruction with staff names replaced by placeholders. No names, contact details, rates or schedules.
• Twilio Inc. — SMS notifications — switched off by default. Location: United States. Data: Phone number and the text of the notification, only where a business enables SMS

2.1Card numbers: payment is taken by the merchant of record, Paddle, on its own pages; no card data enters the Service.

2.2Passwords: stored only as one-way hashes by the authentication provider; no other sub-processor sees them.

2.3Staff names, contact details, pay rates and schedules never go to the assistant (xAI): the text sent is the manager’s instruction with names replaced by placeholders, and the answer is matched back to people inside the Service.

3.1Before we add or replace a sub-processor, we email every account owner at least 30 days in advance and update this page. A business that objects on reasonable data-protection grounds may end the Service before the change takes effect and is refunded the unused part of any prepaid period — see the Data Processing Agreement.

3.2Sub-processors that no longer handle data are removed from this list when the last data has been deleted from them.

4.1Write to contact@techatpt.com. A business that needs the sub-processors' own data protection terms, or a countersigned copy of the Data Processing Agreement, will receive them.