Current sub-processors
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Supabase | Database (PostgreSQL), authentication, and file storage | Account data, Customer Data, session tokens | Australia (Sydney, ap-southeast-2) |
| Google Cloud Platform | Underlying compute for the API and analysis workers | All hosted data | Australia (Sydney, australia-southeast1) |
| Anthropic | Plan analysis, RFI interpretation, and response drafting | Project content submitted to AI features | United States |
| Voyage AI | Text embeddings for semantic retrieval and grounding | Text excerpts from project and public-source content | United States |
| Vercel | Web hosting, content delivery, Web Analytics, and Speed Insights | Web requests and application data handled by the site; page URLs, referrers, device and browser information, approximate location, and performance measurements | United States |
| Resend | Account, invitation, receipt, waitlist, and feedback email delivery | Email addresses, message content, submitted feedback and screenshot links, and delivery status | United States (primary processing operations) |
For information about Resend's email processing, see its Data Processing Addendum. Vercel explains its measurement services in its Web Analytics privacy documentation and Speed Insights privacy documentation.
Payment provider: Stripe
Stripe handles payment processing and fraud prevention. It receives payment details entered in the payment form, purchase amounts and currency, account or organisation identifiers, and device information. Stripe processes information internationally, including in the United States and India.
Stripe acts as a processor for some services and as an independent controller for other activities, including its own fraud prevention and legal compliance. Its processing and retention practices are explained in Stripe's Privacy Policy.
Changes
We may update this list as our infrastructure evolves. Where required by your agreement with us, we will notify you of new sub-processors before they begin processing your data, giving you an opportunity to object.
Questions
For sub-processor or data-protection questions, contact privacy@arro.co.nz.