We use the providers below to deliver the service. Each is a sub-processor under our Data Processing Agreement, under contracts meeting the requirements of the Privacy Act 1988 and the Australian Privacy Principles. Where data is processed outside this market we rely on APP 8 — reasonable steps to ensure an overseas recipient does not breach the Australian Privacy Principles.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Clerk | Sign-in and user accounts | Name, email, credentials, session data | United States |
| Stripe | Subscription billing | Billing contact and subscription details; card data is held by Stripe, never by us | United States / Ireland |
| Vercel | Website hosting, content delivery, privacy-friendly analytics, bot detection on the demo form | Technical and usage data (IP address, pages visited) and browser characteristics | United States / global edge network |
| Railway | Application (API) hosting | All service data in transit while a request is handled | United States / European Economic Area |
| Neon | Primary database (managed PostgreSQL) | All structured service data — accounts, projects, variations, valuations | United Kingdom / European Economic Area |
| Amazon Web Services (S3) / Cloudflare R2 | Storage of uploaded evidence | Photos, signatures, documents and their metadata | United Kingdom / European Economic Area |
| Resend | Transactional email — submissions, alerts, receipts | Recipient addresses and message content | United States |
| Google (Gemini API) | AI reading of payment schedules, only for documents you actively upload to the extractor | The complete PDF you upload, including whatever it contains. Redact first if it holds something you would rather not send | United States |
| Anthropic (Claude API) | The assistant on our public website, where it is switched on. Not used inside the signed-in product | What a visitor types into the chat and our replies. Not linked to an account | United States |
| Postmark (ActiveCampaign) | Inbound email capture — the address that turns a forwarded email into a record | Sender, subject, body and attachments of emails sent to a project address | United States |
| Xero | Accounting integration. Off unless your organisation connects it | Customer contact details and invoice lines for the valuations you push | United States / Australia / European Economic Area |
| Sentry (Functional Software, Inc.) | Application error monitoringBuilt in but switched off — nothing is being sent to it today. Listed because enabling it is a configuration change and you should have notice in advance rather than find out afterwards. | When enabled: stack traces, browser and request metadata. No session recording | United States |
This list changes as the service does. It is maintained here, and we will tell you before adding a sub-processor so you can object on reasonable data-protection grounds.
Questions about any of this: info@variationflow.com.