Trust
Subprocessors
The third parties startbuddi relies on to run the service, what each one sees, and where it runs. Last updated 16 September 2026.
startbuddi processes customer data on behalf of workspaces under the Data Processing Addendum. The providers below process that data for us, each under its own data processing agreement, and only for the purpose stated. Providers marked “when connected” receive data only after a workspace links that service itself.
| Provider | Purpose | Data processed | Region | Terms |
|---|---|---|---|---|
| Vercel Inc. | Application hosting and serverless compute | All request data in transit; application logs | EU (Frankfurt) functions; global edge network | DPA / terms |
| Supabase Inc. | Database, authentication and file storage | All workspace and account data at rest | EU (Ireland, eu-west-1) | DPA / terms |
| Resend (via Amazon SES) | Sending email — transactional, campaigns, automations | Recipient addresses, message content, delivery events | EU (Ireland, eu-west-1) | DPA / terms |
| Brevo | Audience sync for platform newsletters (startbuddi’s own, not customers’) | Account holder name and email | EU (France) | DPA / terms |
| Anthropic PBC | AI assistant (Chip) — generation and agents | The prompt and the permission-scoped workspace context needed to answer it; zero-retention API terms | United States | DPA / terms |
| OpenAI, L.L.C. | AI assistant fallback and embeddings | As above; zero-retention API terms | United States | DPA / terms |
| Stripe, Inc. | Card payments, subscriptions, payouts (Stripe Connect) | Billing details, payment method tokens, invoice amounts | United States / EU | DPA / terms |
| Paystack Payments Ltd | Card, transfer and mobile-money payments in Africa | Billing details, payment references, payout accounts | Nigeria | DPA / terms |
| Meta Platforms, Inc. | WhatsApp Business, Messenger, Instagram and Facebook — when connected | Messages, contact phone numbers/handles, page content, lead-ad submissions | United States / global | DPA / terms |
| Google LLC | Sign in with Google; Calendar, Gmail, Drive, Sheets, YouTube — when connected | Identity (sign-in); the data of each product a workspace connects | United States / global | DPA / terms |
| Pusher (MessageBird) | Real-time updates in the app (presence, inbox, notifications) | Event payloads: ids and short notification text | EU | DPA / terms |
| Upstash, Inc. | Job queue (QStash) and rate-limit counters | Job payloads: ids and scheduling metadata | EU | DPA / terms |
| Functional Software, Inc. (Sentry) | Error monitoring | Stack traces, request paths, user id on errors | EU | DPA / terms |
| Brandfetch | Company logos and brand colours for contacts and sites | Company domain names | EU | DPA / terms |
| Name.com, Inc. | Domain registration on a workspace’s behalf — when purchased | Registrant contact details required by ICANN | United States | DPA / terms |
Changes to this list
We add a provider here before it starts processing customer data. Workspace owners receive an email at least 14 days before a new subprocessor is added, and may object under section 6 of the DPA. Historic versions of this page are available on request to privacy@startbuddi.com.