Last updated: [LAST UPDATED DATE]
1. These providers may handle personal information so that we can run Valufield. "All firms" means the provider is used for every account. "If turned on" means only when the firm, or our platform, enables that feature.
2. We will update this list at least [SUBPROCESSOR NOTICE DAYS] days before a new provider starts handling firm data. To be told of changes, email [PRIVACY EMAIL].
| Provider | What it does for Valufield | Where data is handled | Used for | Terms and data protection |
|---|---|---|---|---|
| Supabase (Supabase Pte. Ltd.), on Amazon Web Services | Database, sign-in, file storage, backups | Sydney, Australia (AWS ap-southeast-2). Supabase staff may access it from other countries for support and operations | All firms | Terms, DPA, Sub-processors |
| Vercel Inc. | Runs the application, content delivery, request logs | Application functions in Sydney (syd1). Builds, logs and cached content in the United States and a global network | All firms | Terms, DPA |
| Stripe (Stripe Payments Australia Pty Ltd; Stripe, LLC) | Subscription billing and card payments to us; payments firms take from their clients through Stripe Connect | Australia and the United States, and other countries where Stripe's affiliates operate | All paying firms; Connect if turned on | Australian terms, Privacy, DPA, Connected Account Agreement |
| Resend | Sends sign-in, invitation and notification emails, and firms' own emails and campaigns; records delivery, bounce, open and click events | United States (Resend stores all account and email data there) | All firms | Legal, DPA, Sub-processors |
| Anthropic PBC | AI features: call summaries, call notes, call scoring, knowledge base answers, drafting and automation AI steps | United States. Model processing may also run in other countries | If turned on | Commercial Terms, DPA, Trust Center |
| Twilio Inc. | Phone numbers, SMS, calls, voicemail and call recordings (one Twilio account per firm); Australian number registration | United States (Twilio's US1 region) | If turned on | Terms, DPA, Sub-processors |
| ElevenLabs (Eleven Labs Inc.) | Call transcription, the AI receptionist, and voices for the training simulator | United States | If turned on | Terms, DPA, Privacy |
| Cloudflare, Inc. (Turnstile) | Bot protection on public forms | Cloudflare's global network | If turned on | Turnstile privacy addendum |
3. Services a firm or user connects. These are the firm's own providers, not ours. When a user connects one, data moves between Valufield and that provider under the firm's own agreement with it.
| Provider | What it does in Valufield | Where data is handled | Used for | Terms |
|---|---|---|---|---|
| Google (Gmail, Google Calendar, Sign in with Google) | Mailbox sync and sending, calendar busy times, sign-in | Google's global infrastructure | If a user connects it | API Services User Data Policy, Privacy |
| Microsoft (Outlook, Microsoft 365 calendar, sign-in) | Mailbox sync and sending, calendar busy times, sign-in | Microsoft's global infrastructure | If a user connects it | Privacy statement |
| Xero, MYOB, QuickBooks, HubSpot, Pipedrive, Salesforce, DocuSign | Syncing contacts, invoices, deals or signatures | Set by each provider | If a firm connects it | The firm's own agreement with that provider |
4. Not used at launch. The software can also use Sentry (error tracking), OpenAI or Voyage AI (knowledge base search), and OpenAI or Google (alternative AI providers). None is turned on. We will add any of them to the table above, with notice under item 2, before it handles personal information.