Companies we use (sub-processors)
Last updated: October 7, 2026
In short
These companies process personal data on our behalf, under data processing agreements. “Chart data” means the content of your charts, for which we are your processor; only Supabase and Vercel handle it. We will update this page, and email business customers, at least 30 days before adding or replacing a company that handles chart data.
List
Status “In use” means it is running today.
| Company | What it does | Data involved | Where | Status |
|---|---|---|---|---|
| Supabase Inc. | Database, sign-in and photo storage | Account data, chart data | EU, Frankfurt (Germany) | In use |
| Vercel Inc. | Hosting and delivery of the website, server functions | Requests to the website including IP addresses; chart data passes through | Frankfurt, Germany (fra1) | In use |
| Stripe Payments Europe, Ltd. (Stripe group) | Payments, subscriptions, tax and invoices | Billing data; never chart data | EU and USA | In use for paid plans |
| Google Ireland Ltd. (Google group) | Sign-in with Google, only if you choose it | Your Google email, name, profile picture link and account ID; never chart data | EU and USA | In use |
| Resend Inc. | Account emails: sign-up confirmation and password reset | Email address, the email content | EU, Ireland (Resend Inc. is a US company) | In use |
| Vercel Inc. | Vercel Web Analytics: anonymous page-visit statistics, only with your consent | Visited page without tokens, referrer, country, device type; no cookies | USA (EU Standard Contractual Clauses, Data Privacy Framework) | In use |
| PostHog | Product analytics, EU cloud, only with your consent | Usage data | EU | Planned, not active |
Sign-in emails
Sign-up confirmation and password-reset emails are sent by Resend (Resend Inc., USA) on our behalf.
Transfers outside the EU
Supabase, Vercel, Google, Stripe and Resend belong to groups based in the United States. Transfers are protected by the EU Standard Contractual Clauses and, where the company is certified, the EU-U.S. Data Privacy Framework.