Sub-processors
These are the companies that process personal information on our behalf so we can run Socialcarbs. Each one is bound by contract to process it only on our instructions and only to provide its service to us.
1. Always engaged
| Provider | What it does for us | What it processes | Where |
|---|---|---|---|
|
Google Cloud Platform Google LLC |
Hosting, file storage, secret storage, scheduled jobs and the background task queue. | All application data, in transit and at rest. | United States |
|
Supabase Supabase, Inc. |
Managed PostgreSQL database and daily backups. | All application data. | United States |
|
Stripe Stripe, Inc. |
Subscription billing, and payment processing for online stores. | Billing contact details and payment details. Card numbers go directly to Stripe and are never stored by us. | United States |
|
Twilio SendGrid Twilio Inc. |
Transactional email: order notifications, invites, password resets. | Recipient name and email address, and the content of the message. | United States |
|
Google reCAPTCHA Enterprise Google LLC |
Detecting automated abuse on sign-in, sign-up, password reset and public forms. | IP address, browser characteristics and interaction signals. | United States |
|
Anthropic Anthropic, PBC |
Powers the in-app help assistant, the photo-order reader and point-of-sale item matching.
Engaged when a question is asked or a photo is submitted. |
The content of questions put to the help assistant, and the results of the lookups it runs to answer them, which can include order, customer and user records. Images submitted to the photo-order feature. | United States |
|
Sentry Functional Software, Inc. |
Error and performance monitoring.
Only when error monitoring is enabled for the environment. |
Technical error reports. Personal information is excluded at the client (send_default_pii is off), so reports carry stack traces and request metadata rather than user data. | United States |
|
Redis The provider configured for the deployment |
Session storage, caching and rate limiting.
Only when a Redis instance is configured; otherwise sessions are cookie-based. |
Session identifiers and short-lived cached values. | United States |
2. Engaged only if you connect them
These are not engaged unless you choose to connect your own account. You can disconnect at any time.
| Provider | What it does | What it processes | Where |
|---|---|---|---|
|
Intuit QuickBooks Online Intuit Inc. |
Creating and updating invoices on request. | Customer and invoice details for the invoices concerned. | United States |
3. Content delivery and fonts
Loading a page also fetches scripts and fonts from the hosts below. They are not sub-processors in the legal sense — they hold none of your data — but they do see the IP address of anyone loading a page, so they are listed for completeness. The Cookie Notice has the detail.
code.jquery.com— Serves a JavaScript library.cdn.jsdelivr.net— Serves JavaScript and CSS libraries.unpkg.com— Serves a JavaScript library.fonts.googleapis.com— Serves web font stylesheets.fonts.gstatic.com— Serves web font files.www.google.com— reCAPTCHA Enterprise anti-abuse checks on sign-in and public forms.www.gstatic.com— Serves the reCAPTCHA client script.js.stripe.com— Serves the Stripe payment form.
4. Changes to this list
When we add or replace a provider that processes personal information, we update this page. If you would like to be told when that happens, email privacy@socialcarbs.com and we will add you to the notification list.