Subprocessors

Supabase, Inc.

Hosted PostgreSQL database, authentication, API, and database backups. The Firetender production project is configured in Stockholm, Sweden. Account and club data are processed.

• Location: EEA project region; provider support and corporate operations may involve approved transfers.
• Safeguard: DPA and applicable transfer mechanism.

Cloudflare, Inc.

Application hosting, content delivery, DNS, TLS, network security, and operational logs. Requests and limited technical metadata are processed at Cloudflare’s global edge.

• Location: global edge network.
• Safeguard: DPA and EU Standard Contractual Clauses where required.

Stripe, Inc. / Stripe Payments Europe, Limited

Subscription Checkout, invoicing, tax information, payment status, and Customer Portal. Stripe receives customer billing information and payment credentials directly; Firetender receives identifiers and status, not card numbers.

• Location: EEA and other locations described by Stripe.
• Safeguard: Stripe data-processing terms and applicable transfer mechanism.

Resend, Inc.

Operational and customer-requested email delivery. Recipient address, sender, subject, message content, and delivery metadata are processed.

• Location: provider infrastructure described in Resend’s terms.
• Safeguard: DPA and applicable transfer mechanism before production use.

Google Ireland Limited / Google LLC

Optional Google Ads click attribution and website conversion measurement for Firetender’s own customer acquisition. Google measurement is not loaded before consent and does not receive club member records or message content. Google may process browser, device, and network information under its advertising data terms.

• Location: Google’s global advertising infrastructure.
• Safeguard: Google Ads data terms, consent controls, and applicable transfer mechanism.

GitHub, Inc.

Private source-code hosting and release automation. Production member data and production secrets are not intentionally stored in the repository.

• Location: provider infrastructure.
• Safeguard: access controls, private repository, and no production customer datasets.

Change notice

Material changes are posted here before production use. Customers may send substantiated objections to amundskristiansen@gmail.com.