This page lists everyone else who touches your data when you use Tipslip, what they do with it, and where it's processed. It's written for a skip-firm owner, not a lawyer — if a word needs a lawyer to understand, we've failed at this page.
A "sub-processor" is a company we hire to help run Tipslip, who ends up handling some of your (or your customers', or your drivers') personal data as part of that job. We stay responsible for what they do with it — using one doesn't let us pass the buck.
Every fact below is checked against what the product actually does, in legal/product-facts.md. Where that dossier could not confirm something, this page says so rather than guessing.
Sub-processors
| Sub-processor | What it does for Tipslip | Personal data it may receive | Processing location | Safeguard |
|---|---|---|---|---|
| Supabase | Our database and file storage, and sign-in for office staff accounts | Everything in the product: firm, driver and customer contact details, job data, GPS coordinates, photos, signatures, generated PDFs, office login | Confirmed: UK — eu-west-2 (London) for the database. Storage is understood to be co-located in the same project/region, but that has not been separately confirmed. UK/EU — confirm with vendor for Storage specifically, and for wherever Supabase's own corporate entity sits relative to UK GDPR. | UK GDPR Article 28 terms via Supabase's own DPA. Transfer mechanism (if any data leaves the UK) — to confirm. |
| Vercel | Hosts the office app, marketing site and driver app, and runs our background job functions | Whatever passes through those apps: all of the above, plus whatever Vercel's own platform-level request logging captures | Confirmed UK — lhr1 (London) — for the office app and marketing site. The driver app project has no region pinned in its config. UK/EU — confirm with vendor for the driver app specifically. | UK GDPR Article 28 terms via Vercel's DPA. Transfer mechanism — to confirm. |
| Resend | Sends transactional email: your waste transfer note / receipt PDFs to customers, billing reminders to you, status-page alerts, and marketing enquiry replies | The recipient's email address, and the PDF attached to it | UK/EU — confirm with vendor. Not stated anywhere in our own systems; Resend is a US company. | UK GDPR Article 28 terms via Resend's DPA. Transfer mechanism to confirm — likely the UK-US Data Bridge or the UK IDTA/Addendum, depending on how Resend structures its own transfers — to confirm. |
| Stripe | Billing: checkout, the customer portal, invoices, add-on charges | Your firm's billing contact name/email, plan, subscription status. Card and payment details go straight to Stripe — they never reach our own systems. | UK/EU — confirm with vendor. Not stated anywhere in our own systems. | UK GDPR Article 28 terms via Stripe's DPA. Flag: for the card/payment data itself, Stripe is very likely acting as an independent controller, not our processor — this needs the solicitor's sign-off on the wording. Transfer mechanism for anything Stripe processes as our processor — to confirm. |
| Inngest | Runs background jobs: retrying Defra submissions, the billing sweep, generating and emailing documents, deadline alerts | Mostly firm/job/receipt IDs. Some events (document generation) carry IDs that resolve back to personal data once a person looks them up, though the event payload itself is mostly identifiers rather than raw personal data. | UK/EU — confirm with vendor. Not stated anywhere in our own systems. | UK GDPR Article 28 terms via Inngest's DPA. Transfer mechanism — to confirm. |
| Cloudflare | Hosts our public status page and an automated health check ("canary"); DNS for the status page's subdomain | Status page: email addresses of people who sign up for incident alerts. Canary: sandbox test data only — never a real customer's data. | UK/EU — confirm with vendor. Cloudflare's storage for this ("D1") has a configurable home region; ours has not been set, so this is unconfirmed. | UK GDPR Article 28 terms via Cloudflare's DPA. Transfer mechanism — to confirm. |
| Plausible | Website visit analytics on the marketing site. Not switched on today; listed so that switching it on does not add a new supplier | None that we can identify — Plausible is built to be cookie-free and not to track individual visitors across sites. | UK/EU — confirm with vendor. Plausible's own marketing says EU-hosted by default; we have not independently confirmed this. | UK GDPR Article 28 terms via Plausible's DPA. Transfer mechanism — to confirm, though if Plausible receives no personal data this may turn out not to matter. |
| Hosts our support mailbox (Google Workspace / Gmail) at support@tipslip.co.uk | Whatever a customer, driver or prospect writes to support, including any attachments | UK/EU — confirm with vendor. | UK GDPR Article 28 terms via Google Workspace's own DPA — to confirm. |
Whose data each one handles. Supabase, Vercel, Resend, Inngest and Google can handle personal data in your firm's records, so under our data processing agreement they are sub-processors of your data. Stripe, Cloudflare and Plausible handle only data we control ourselves (billing contacts, status-page subscribers, website visits); we list them here so you can see everyone we use.
Other recipients (not sub-processors)
Defra's Waste Tracking service. When your driver records a delivery to a permitted site, Tipslip submits the movement to Defra because the law requires it — that's the whole point of the product. Defra is not doing this "for us" the way a sub-processor does; Defra is a regulator receiving a statutory report, and is its own independent controller of what it does with it. What we send: waste codes, weights, site/permit details, the carrier's registration number, the vehicle registration (per data-map.md §8), and hazardous-waste details where they apply. We do not send driver GPS coordinates, photos, or signatures to Defra — the record we build only carries the fields Defra's own schema defines.
Not used
None of the following are anywhere in the Tipslip codebase today, checked directly against the source rather than assumed:
- AI / LLM services (e.g. OpenAI, Anthropic) — no such service is called by any deployed app or worker function.
- SMS — no SMS provider processes customer or driver data. Twilio appears only in our own internal on-call/status-page alerting code, no Twilio account or credentials exist yet, and it never touches customer, driver or firm data.
- Error tracking (e.g. Sentry) — no first-party error-tracking call exists anywhere. A handful of Sentry packages show up in the dependency tree only as an indirect dependency of our accessibility/performance testing tooling, not as something the product itself uses.
- Session replay (e.g. tools that record what a visitor does on screen) — none found.
(All four checked against legal/product-facts.md §3.)
How we change this list
- New sub-processor: we'll email the account owner at least 30 days before a new sub-processor starts processing your data, naming who they are and what they'll do.
- Like-for-like replacement: if we're swapping one sub-processor for a directly equivalent one purely for security or availability reasons, we'll give 14 days' notice instead, and say why.
- Objecting. *(Draft — for solicitor review.)* You can object by emailing us within the notice period. If we can't resolve your objection, you may terminate the affected service and we'll refund any fees you've already paid for the part of the term you won't be using.
How we keep this current
scripts/check-sub-processors.mjs (pnpm check:sub-processors, run in CI) scans the codebase for new outbound hostnames, third-party SDK dependencies, and vendor-shaped credential names in .env.example, and fails the build if it finds one that isn't registered in legal/sub-processors.json and this page.
Change history
| Version | Date | Change |
|---|---|---|
| 0.1 | 2026-09-25 | First draft. Sub-processors and other recipients as found by legal/product-facts.md §3. |
| 0.2 | 2026-09-25 | Added Google (Google Workspace / Gmail support mailbox) as a sub-processor; noted that Defra receives the vehicle registration (data-map.md §8) in the Defra entry. |