Sub-processors

Version 2026-10-22

Draft. This document is a working draft and has not yet been reviewed by a lawyer. Passages marked [LAWYER REVIEW] or shown in [square brackets] are still to be confirmed.

These are the outside services that handle data on Basenyx's behalf, what they are used for, and where. It is the same list as in our Privacy Policy.

Supabase
What for:
Database, sign-in (authentication) and file storage.
Data involved:
Everything stored in your account: account details, client records, invoices, quotes, bills, messages and uploaded documents.
Where:
[CONFIRM: the region of the production Supabase project]
Vercel
What for:
Hosting and running the application.
Data involved:
Requests and responses in transit, and server logs. Application code runs in the Sydney region.
Where:
Application functions: Sydney, Australia. Vercel's network and logging may involve other locations [CONFIRM].
Stripe
What for:
Taking card and bank-debit payments, paying businesses out, and billing for Basenyx plans.
Data involved:
Payer name and email, payment amounts and invoice references. Card and bank details go directly to Stripe and are not stored by Basenyx.
Where:
Stripe processes data in several countries, including outside Australia [CONFIRM].
Resend
What for:
Sending email: invoices, quotes, reminders, portal invitations, security alerts and billing notices.
Data involved:
Recipient email addresses and names, and the content of each email.
Where:
[CONFIRM: Resend's processing location]
Sentry
What for:
Finding and fixing errors.
Data involved:
Technical error reports, with the business and user identifiers and a request identifier attached. Bug reports a person chooses to submit.
Where:
[CONFIRM: the Sentry data region configured for the project]
Cloudflare (Turnstile)Used only when switched on
What for:
The security check on sign-in, sign-up and password-reset forms, which stops automated password guessing and fake sign-ups.
Data involved:
Technical details of the visitor's browser and connection (such as IP address and browser signals) while the check runs. No account or business data.
Where:
Cloudflare's global network, including outside Australia [CONFIRM].
MapboxUsed only when switched on
What for:
Optional address lookup, so jobs can be placed on a map when suggesting the order of a day's visits. Not in use unless switched on.
Data involved:
The site address of a job and the business's depot address. No names or other client details.
Where:
United States [CONFIRM].
AnthropicUsed only when switched on
What for:
The AI assistant, and reading scanned stock and supplier documents. Only used for a business that has the assistant switched on.
Data involved:
The person's question and the business records the assistant looks up to answer it (for example client names, invoice amounts, project details), limited to what that person is allowed to see.
Where:
United States [CONFIRM].
OpenAIUsed only when switched on
What for:
Matching a question to the help articles (search embeddings). Only used when switched on.
Data involved:
The text of a question typed to the assistant.
Where:
United States [CONFIRM].
BasiqUsed only when switched on
What for:
Optional live bank feed (Open Banking). Not in use unless a business connects a bank.
Data involved:
The bank accounts a business chooses to connect, and their transactions (date, description, amount), read with the business's consent.
Where:
[CONFIRM]
SkriptUsed only when switched on
What for:
Optional live bank feed (Open Banking, Consumer Data Right). Not in use unless a business connects a bank.
Data involved:
The business's name, email, mobile number and ABN (to set up the connection), and the bank accounts it chooses to connect with their transactions (date, description, amount), read with its consent.
Where:
[CONFIRM]
TwilioUsed only when switched on
What for:
Optional text messages. Not in use unless a business turns texting on.
Data involved:
The mobile number of the person being texted, the text itself (for example a payment reminder with a link to their invoice), and any reply such as STOP.
Where:
[CONFIRM]