Legal & privacy
The services we use
The providers documented for the hosted app, what they handle and the locations we can verify. This draft register is under review; it is not an Australian-only processing guarantee or a complete list of each provider’s own suppliers.
Last updated: 8 October 2026.
Core storage in Sydney; other processing may occur overseas.
| Provider | What they handle | Location information | Verified |
|---|---|---|---|
| Supabase | Account authentication, main database and private document storage. Handles account, care and business records. | Core project: Sydney, Australia (ap-southeast-2). Provider support locations need review. | 7 Oct 2026 |
| Google Cloud | Backend hosting, document processing, encryption keys and operational logs. | Configured services: Sydney, Australia (australia-southeast1). Provider operations may be international. | 7 Oct 2026 |
| Vercel | Web app hosting, rendered pages, request metadata and limited marketing traffic analytics. | United States and other provider operating locations; complete country list under review. | 8 Oct 2026 |
| Resend | Sign-in codes, invitations and notification emails; recipient, message and delivery information. | Sending: Tokyo, Japan (ap-northeast-1). Stored email data: United States. | 8 Oct 2026 |
| ClickSend (when text delivery is enabled) | Optional account, setup, trial and plan-update texts for people who choose them; destination phone number, message, links and delivery information. | International processing by ClickSend and delivery partners; locations require review. | Provider disclosures: 8 Oct 2026; hosted activation not verified |
| Stripe | Worker subscription checkout, payment details, billing references and status. When identity verification is enabled: identity document, matching selfie and verification result. | International processing; complete country list under review. | 8 Oct 2026 |
Optional website measurement
Meta, Google and TikTok advertising tags may run on marketing and worker sign-up pages when configured and subject to your ad measurement choice. They receive limited browser, device and campaign information, with overseas processing possible. They do not receive care records or form values through our ad events.
Vercel Analytics is restricted to the home, trial and retired waitlist entry routes. Private app, invitation, agreement, shared document, rate-card and other routes are excluded. Optional push delivery requires separate configuration.
Optional text messages
ClickSend is the provider selected for text updates when delivery is enabled. The register describes this conditional use; it does not establish that hosted text delivery is active. Providing a phone number at trial sign-up does not subscribe you to marketing texts. You can choose or stop optional updates in Email and text preferences.
ClickSend and its delivery partners may process information outside Australia. Read ClickSend privacy and its subprocessor list for provider disclosures.
Storage and other processing
The main database and document storage use Sydney regions. Email sending location differs from email storage location. Website requests, billing, logs, vendor support and provider operations may involve other countries. The complete country list and provider contracting details still require review.
Read the app privacy policy for data categories, disclosures, provider policy links and your choices. Contact us about a particular flow if its location affects your decision to use it.
Changes and questions
We will update this page when configured providers or their documented purposes change and explain material changes through an appropriate notice. This draft does not promise a fixed advance-notice process that has not been established.
For privacy questions, email hello@thimblecare.com.