Subprocessor register
Quotely (Ireland) uses the following subprocessors to deliver the service. This list supplements our Privacy Policy.
| Subprocessor | Purpose | Location | Safeguards |
|---|---|---|---|
| Supabase | Database, authentication, scheduled retention jobs | European Union (project region) | DPA, encryption in transit and at rest |
| Mailgun (Twilio) | Transactional email delivery | EU region when configured (MAILGUN_REGION=eu) | DPA, EU endpoint option |
| Stripe | Subscription billing and payment processing | United States / global | Stripe DPA, SCCs, PCI DSS |
| Vercel | Web hosting, API routes, scheduled crons | EEA and global edge regions | DPA, SCCs where applicable |
| Expo push notification service | Mobile push delivery | United States | Vendor terms, minimal device token data |
| Google (Firebase Cloud Messaging / Play Services) | Android push notification delivery | United States / global | Google Cloud DPA, SCCs where applicable |
| Expo EAS | Mobile app build hosting and distribution | United States | Vendor terms |
| OpenAI | Optional AI-assisted receipt field extraction | United States / global | DPA and SCCs; receipt data sent only on user request |
| RevenueCat | Mobile subscription entitlement management | United States / global | DPA, SCCs, pseudonymous application user identifier |
| Apple | App Store subscription billing and purchase processing | European Union / global | Apple privacy and data-processing terms |
We will update this page when subprocessors change. Material changes will be notified via email or in-app notice where required.