Dernière mise à jour :
Ce document est fourni uniquement en anglais. Il intègre les Clauses Contractuelles Types de l'UE, dont les traductions officielles ne doivent pas être paraphrasées ; la version anglaise fait donc foi.
These are the third parties that may receive personal data when you use SupDesk. It is the list referenced by section 7 of our Data Processing Agreement, and it is the authoritative one.
Engaged by us to provide the Service. Every customer's data may pass through these, and they are the providers the objection right applies to.
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, and file storage. | United States |
| Cloudflare | Hosting, CDN, attachment storage, bot protection, live chat infrastructure, and AI inference. | United States and global edge network |
| Stripe | Payment processing and subscription billing. | United States |
| Resend | Transactional and changelog email delivery, including the subscriber lists used for changelog broadcasts. | United States |
| Website analytics through Google Tag Manager, loaded only with the visitor's consent. | United States | |
| OneSignal | Push notification delivery for the mobile apps. | United States |
| Sentry | Crash and error diagnostics for the mobile apps. | United States |
| Expo | Mobile app builds and over-the-air updates. | United States |
These receive data only when a project switches on the corresponding integration or issues an API key. They act on your instruction rather than as our sub-processors, so what they do with the data is governed by your agreement with them. They are listed here for completeness, and no notice period applies because nothing is sent until you turn them on.
| Destination | What is sent | Location |
|---|---|---|
| Slack | Notifications to a connected workspace, including the end-user's email address and an excerpt of their message. | United States |
| GitHub | Copying the title and body of a feedback post into a GitHub issue. | United States |
| Outbound webhooks | Event payloads delivered to a URL the project specifies; a copy of each delivery is retained so it can be inspected and retried. | Determined by the customer |
| OpenAI, Anthropic, or Google | AI processing when a project supplies its own provider API key, under that project's own agreement with the provider. | United States |
