Current providers
Supabase Pte. Ltd.
- Role
- Subprocessor for merchant end-customer data; processor for Ziphy account data handled on Ziphy’s behalf.
- Purpose
- PostgreSQL database, authentication, backups and related platform operations.
- Broad data types
- Account identifiers, authentication data, merchant settings, customer subscription/payment/cancellation/recovery records, operational records.
- Location
- Primary Ziphy database, Auth and backups: West EU (Ireland). Limited support and operations may involve Singapore, the United States and other listed locations.
- Transfer basis
- Supabase DPA, standard contractual clauses and supplementary safeguards where applicable.
Vercel Inc.
- Role
- Subprocessor for personal data handled by the hosted application; separate controller for its own account and service-administration data.
- Purpose
- Application hosting, server runtime, delivery and operational logs.
- Broad data types
- Web requests, account/session data passing through the application, limited operational metadata and error information.
- Location
- United States and other locations used by Vercel and its providers. Runtime location may vary by platform routing and configuration.
- Transfer basis
- Applicable Vercel data-processing and UK transfer terms, including the UK Addendum where required.
Plus Five Five, Inc. (Resend)
- Role
- Subprocessor for merchant end-customer data and processor for Ziphy transactional account email.
- Purpose
- Delivery of authentication, transactional and failed-payment recovery email.
- Broad data types
- Recipient email, merchant/business identity, message content, delivery status and limited delivery metadata.
- Location
- United States and other locations used by Resend’s listed providers.
- Transfer basis
- Resend DPA and applicable standard contractual clauses or UK transfer safeguards.
Stripe
- Role
- Multiple roles: processor for some payment services and an independent controller for purposes such as fraud prevention, regulatory compliance and Stripe service administration.
- Purpose
- Ziphy subscription billing, Stripe Connect, merchant subscription changes, failed-payment recovery and authoritative payment records.
- Broad data types
- Account and connected-account identifiers, customers, subscriptions, invoices, amounts, currencies, payment status and payment-method data handled by Stripe.
- Location
- United Kingdom, Ireland, United States and other locations described in Stripe’s services and provider documentation.
- Transfer basis
- Stripe DPA and Data Transfers Addendum, including the UK Addendum and other mechanisms where applicable.
Changes to this list
The merchant gives general authorisation for the subprocessors above under the Data Processing Addendum. Ziphy will post changes here and give reasonable advance notice of a material new or replacement subprocessor by email or in-product notice.
A merchant may object on reasonable data-protection grounds by contacting support@ziphy.io. Ziphy and the merchant will try to find a practical solution; if none is available, the merchant may stop the affected service and terminate it.
Role clarification
A provider's role depends on the processing. Stripe, in particular, may act as both processor and controller. Providers may also act as independent controllers for their own billing, security, fraud-prevention or legal compliance. Their linked notices explain those separate activities.