Sub-processors
Last updated 20 October 2026.
These are the companies that process data on our behalf. The region each uses, and the safeguards that apply, are written into the data processing agreement we sign with a customer, because they depend on the setup chosen for that deployment. The trust page says what we store and for how long.
| Company | What it does for the service | Data it handles |
|---|---|---|
| Supabase (database, sign-in, file storage) | Stores the service’s data, sends staff their sign-in link, and stores pictures, logos and videos. | All the data in the service, including staff email addresses and the files customers upload. |
| The hosting platform for the application (Vercel) | Runs the application and serves it to phones and staff. | Everything in transit, and the request logs the host keeps (network addresses, pages, times). |
| Stripe, when card payment is switched on | Takes card payments for Event Passes and issues invoices. | The buyer’s name, email, billing address and VAT number, and their card details (which we never see). |
| An email provider (Resend), if switched on | Sends team invitations and notifications of messages from this website. | The recipient’s email address and the message. |
Not used
Analytics, advertising, third-party scripts, third-party fonts, and map or video embeds. No delegate or staff data is sent to any company other than those above. One exception a producer chooses: a live-presentation slide loads that presentation from Google or Microsoft on the display computer alone, never on a delegate’s phone.
Two things that are not sub-processors
- A website scan when an event is created. To find an event’s own website for its colours and logo, the product searches Wikidata (run by the Wikimedia Foundation) with the event’s name or acronym, and fetches the website it finds. No delegate or staff data is sent.
- Phones load pictures directly from our storage provider. Logos, backgrounds and slide pictures reach a delegate’s phone as a link to the storage provider’s address, so that provider sees the phone’s network address when a picture loads.
Changes
We tell customers before we add or replace a sub-processor, and the notice period is set in the data processing agreement. A customer may object as that agreement sets out.