1The list
Each provider below is bound by data-protection terms with us that limit it to handling data to provide its service to us.
Vercel Inc. · Hosting and delivery
ReceivesEvery request to the Service, including the network address and browser details that come with it, and the pages and data sent back. Vercel keeps short-lived request logs.
WhyIt runs the application and serves it over an encrypted connection.
WhereUnited States
Used onDemonstration and client service
Supabase, Inc. · Database and file storage
ReceivesEverything stored in the Service: accounts, workspace data, filings, the change log, and uploaded specification documents.
WhyIt hosts the database and the file store. The demonstration and the client service each have their own project.
WhereUnited States (Amazon Web Services, Oregon)
Used onDemonstration and client service
Resend · Sending email
ReceivesEach email we send: the recipient's address and name, the workspace or company it concerns, the sender's address as the reply-to, and the message, which holds a one-time link.
WhyIt delivers account invitations, demonstration access invitations and password-reset emails.
WhereUnited States
Used onDemonstration and client service
Google LLC (Google Workspace) · Our mailbox
ReceivesEmail you send to our addresses, including privacy requests and security reports, and our replies.
WhyIt hosts the mailbox our legal, privacy and security addresses deliver to.
WhereUnited States
Used onDemonstration and client service
2Built, and switched off
These features exist in the code and send nothing to anyone today.
- Reading uploaded specification sheets with an AI model. This feature exists in the code and is switched off. It would send a document's contents to an AI provider. Before it is switched on we will add the provider to this list and give customers 30 days' notice, and it refuses a supplier's confidential document unless a zero-retention agreement with the provider is on file.
3When this list changes
Before a new provider starts receiving customer data, we add it here and email each workspace’s administrators at least 30 days ahead. A customer may object, as our data processing agreement describes. The “last updated” date above changes with the list. Questions go to legal@trashclubventures.com.