These providers may process personal data on our behalf. Each is bound by a written data-protection agreement. We give customers at least 30 days' notice by email before adding a new sub-processor, and customers may object as described in the Data Processing Agreement.
Core service
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Vercel Inc. | Application hosting, CDN, serverless functions, custom domains, cookieless page analytics | All data passing through the application; request logs (IP address, user agent) | USA / global edge network |
| [Database provider] | Primary PostgreSQL database | All workspace and account data | [Hosting region] |
| [File storage provider] | File storage (unit media, floor plans, generated PDFs, logos, marketplace photos) | Uploaded files and generated documents | [Hosting region] |
| Resend, Inc. | Transactional email (password resets, offers, reminders, lead notifications) | Recipient name and email address, email content | USA |
| Paddle.com Market Ltd | Merchant of Record for subscriptions and listing boosts | Billing name, email, country and payment details (held by Paddle, never by us) | United Kingdom / global |
Only when a customer uses the feature
| Provider | Purpose | Data | Location |
|---|---|---|---|
| OpenAI, L.L.C. | AI drafting, copilot, image generation and floor-plan tracing | Only the content of AI requests a user triggers | USA |
| Vercel AI Gateway | Routes AI text requests to the configured model provider | Only the content of AI requests a user triggers | USA |
| Replicate, Inc. | AI image rendering (seasonal renders, unit visuals) | Building and unit images | USA |
| Firecrawl | Competitor website analysis | Public competitor web addresses only — no personal data | USA |
| Meta Platforms (Ireland / USA) | WhatsApp notifications; Facebook and Instagram publishing | Team member phone numbers, message and post content | Ireland / USA |
| Telegram | Daily team report notifications | Team member Telegram IDs and report content | Global |