Supabase

Intended use: Postgres, authentication, and object storage for contacts, inspection records, photos, signatures, PDFs, and audit metadata. Intended role: subprocessor for shop records and processor for our account data.

The draft identifies Supabase Pte. Ltd., subject to the actual order. Project and backup regions, support access countries, and contractual evidence remain pending.

Vercel

Intended use: web hosting, server execution, scheduled jobs, and technical logs, including data traversing the app and API. Vercel is a subprocessor where it handles shop records.

The account agreement determines the contracting entity. Execution regions, CDN routing, log retention, and access locations remain pending confirmation; not all processing can be assumed to occur in the US.

Stripe

Intended use: InspectRenew subscription contacts, transaction details, billing addresses, and tax identifiers. Card details are supplied to Stripe. This does not include collection of inspection payments for shops.

Stripe acts as an independent controller for certain payment, fraud, and legal purposes and as a processor for others. It is not a blanket subprocessor for all activities. The account agreement determines the entity and country; those details remain pending.

Resend

Intended use: email sender and recipient details, message content, delivery metadata, and links; attachments only where used. Intended role: subprocessor for shop mail and processor for our account mail.

The draft identifies Plus Five Five, Inc., subject to the actual order. Delivery-log retention, countries, and contractual evidence remain pending. Avoid sensitive information in subject lines.

Twilio — conditional SMS

Intended use when SMS is approved and activated: phone numbers, shop brand and campaign details, permitted message content, delivery metadata, and consent/opt-out records. Customer content and provider service data may have different processing roles.

Activation depends on approved shop onboarding, permission, and suppression controls. Contracting entity, countries, carrier disclosures, downstream providers, and retention remain pending.

Expo — conditional push and EAS

Intended use when enabled: push tokens, notification payloads, delivery metadata, and build/update artifacts for EAS. Installing the Expo SDK does not mean Expo receives every inspection record.

Push delivery also involves APNs or FCM. The applicable Expo entity, DPA, countries, enabled services, and downstream chain remain to be confirmed. A privacy policy alone is not a processing agreement.

Other conditional recipients

Google Analytics, Google Ads, and Meta are optional marketing recipients, not authorized recipients of shop inspection records under the DPA. Enabled products, roles, transfers, and sale/sharing implications need review before activation. Google Tag Manager alone does not establish which tags are active.

Sentry is optional. If enabled for Customer Personal Data, its entity, DPA, categories, and regions must be added before transmission. APNs, FCM, and infrastructure providers must be represented in the relevant direct or downstream chain.

Locations and inventory verification

For each provider, the completed inventory must record the order and DPA acceptance, enabled products, data categories, countries and regions, security review, active/backup/log retention, onward transfers, transfer mechanism, incident contact, review date, and change-notice subscription.

A provider’s registered office is not evidence of storage location. US-only storage or access is not promised. Request the completed inventory before production processing.

Proposed change and objection process

The proposed DPA requires at least 30 days’ notice to the customer’s designated privacy email before a new or replacement subprocessor receives its data. Notice must describe purpose, affected data, countries, and safeguards. Customers may object on reasonable data-protection grounds; the DPA describes the alternative or termination/refund remedy.

This is a proposed contractual notice period requiring operational approval, not a universal legal deadline. The dated register and effective version must accompany the accepted DPA.

Contact

Current website support contact: support@inspectrenew.com.

The operator’s designated legal contact is pending confirmation.