Subprocessors
This is the current list of subprocessors and other service providers for CueHand. It is Schedule 3 of our Data Processing Agreement.
This Schedule distinguishes (A) providers appointed by Sealed to process Customer Personal Data for CueHand, (B) onward providers used by those providers or by CueHand for delivery, and (C) services that act in their own controller capacity or receive only operational metadata. It is not a representation that every provider listed below receives every category of Customer Personal Data.
Provider legal terms and subprocessor lists can change. Sealed will maintain links to the current provider terms and lists and will update this Schedule when a material change affects the processing described here. The exact contracting entity and account-level agreement must be retained in Sealed’s vendor records.
A. Direct subprocessors used to process Customer Personal Data
| Provider and legal entity | Service used by CueHand | Data or access involved | Known processing or access locations / notes |
|---|---|---|---|
| Supabase Pte. Ltd. | PostgreSQL database, authentication and file storage | Workspace records, account identifiers, authentication data, uploaded documents/images and technical metadata. Supabase Auth sends authentication messages through the configured custom SMTP service described below. | Project database and storage region: AWS eu-west-1, Ireland. Supabase’s DPA identifies Supabase Pte. Ltd. at 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513; privacy contact: privacy@supabase.io. Supabase states that it and its subprocessors may process data where they maintain facilities, subject to region-specific commitments. Current list: https://supabase.com/legal/customer-resources/subprocessor-list. |
| Vercel Inc. | Web application and API hosting, server functions and scheduled jobs | Request data and Customer Personal Data passing through application functions, plus IP addresses, device/browser information and technical logs. | Application functions configured for Dublin (dub1), Ireland. Vercel Inc. is a Delaware corporation. Privacy contact: privacy@vercel.com. Current DPA: https://vercel.com/legal/dpa. Vercel’s DPA states it applies to Pro and Enterprise plans; Sealed has confirmed that the prior Hobby-plan issue has been resolved. Sealed must retain account evidence confirming the current eligible plan and DPA coverage. Current subprocessor list: https://security.vercel.com. |
| 650 Industries, Inc. (Expo) | Expo Push Service for mobile push notification delivery | Expo push tokens, device name, member/workspace association and notification title, body, link and tag. The message body may contain client first/last names, event titles, task titles or quote references. | Expo’s terms identify 650 Industries, Inc. as the contracting entity. Expo’s published subprocessor list (updated 19 October 2026) identifies Apple and Google in the United States for push notification delivery. Terms: https://expo.dev/terms. Subprocessors: https://expo.dev/privacy/subprocessors. Expo describes itself as a processor of end-user data when developers use its services to distribute apps. |
| Apple Inc. / applicable Apple entity for APNs | Direct Apple Push Notification service delivery for iOS Live Activities; also an onward delivery provider used by Expo for ordinary iOS push notifications | Direct Live Activity payloads include event title, current and next run-sheet item titles and times, progress counts and a yes/no indicator showing whether a balance remains to be collected. Expo may separately forward ordinary mobile push messages to APNs. | Apple service processing locations and contracting entity depend on the applicable Apple service and developer agreement. Apple Developer documentation advises avoiding sensitive information in Live Activities because they may be visible on a Lock Screen or Always-On display. Sealed must retain the applicable Apple developer agreement and confirm the relevant contracting entity. |
| Cloudflare, Inc. | Cloudflare Turnstile on public enquiry forms and Cloudflare R2 Object Storage for off-site backups | Turnstile: visitor IP address and browser/device signals. R2: encrypted backup archives containing database and stored-file data; the archives are encrypted with age before upload. | Cloudflare is a US provider. R2 bucket jurisdiction/location settings must be confirmed in the Cloudflare dashboard; do not infer the bucket location from the provider’s headquarters. Cloudflare DPA and terms: https://www.cloudflare.com/cloudflare-customer-dpa/. |
| GitHub, Inc. | GitHub Actions executes the scheduled backup workflow on GitHub-hosted runners | The runner temporarily handles database and stored-file backup data before age encryption. Workflow logs and job metadata may also be generated. | GitHub-hosted runner environment is ubuntu-24.04. Source data is present on the runner before encryption; the workflow must not upload plaintext backup files as artifacts or include them in logs. GitHub’s Actions log/artifact retention is separately configurable. Sealed must retain the GitHub plan/terms and repository retention settings. |
B. Onward delivery providers and variable browser infrastructure
These providers may receive data as part of delivery by a provider in Section A or as a result of a user’s choice of browser. They are not all separately appointed by Sealed under a direct processor agreement.
| Provider | Relationship | Data involved | Location / notes |
|---|---|---|---|
| Google LLC / Firebase Cloud Messaging (FCM) | Onward push-delivery provider used by Expo for Android notifications; Google is also a sign-in identity provider selected by the user | FCM receives Android push messages forwarded by Expo. Google Sign-In returns account identifier, email, name and profile photo URL to CueHand/Supabase. | Google push delivery is listed by Expo as a US subprocessor. CueHand does not install a Firebase SDK or directly call FCM. Google Sign-In data is processed in connection with account authentication and is not a general transfer of workspace records to Google. |
| Apple APNs | Onward push-delivery provider used by Expo for iOS notifications; also called directly by CueHand for iOS Live Activities | Push payloads described in Sections A above. | See Apple row in Section A. |
| Browser/platform push service selected by the user’s browser | Browser-selected delivery infrastructure, not a fixed vendor selected by Sealed | Browser push endpoint and technical metadata. Website notification payloads are encrypted using the Web Push protocol before transmission; the service is not intended to receive readable payload content. | Provider depends on the browser/platform and may include Google, Mozilla or Apple services. The browser’s push endpoint identifies the actual service. Sealed does not select a single global browser push provider. |
| Apple Sign in with Apple | Identity provider selected by an account holder; not a subprocessor for Customer workspace content merely because it authenticates the account | Apple user identifier, email (which may be a private relay address) and name where provided on first authorisation; server-side token exchange and token revocation information. | Apple processes identity information under the terms and privacy information applicable to Sign in with Apple. |
C. Operational services and independent controllers
| Provider | Purpose | Information involved | Role and location |
|---|---|---|---|
| SIA Monkey See Monkey Do (Healthchecks.io) | Receives scheduled-job heartbeat pings to monitor whether the backup workflow runs on time | Check-in/status signal and technical metadata. CueHand is not intended to include workspace records, backup contents, customer names or email addresses in the ping. | Healthchecks.io identifies SIA Monkey See Monkey Do, Matīsa iela 61A - 20, Rīga, LV-1009, Latvia; contact@healthchecks.io. Its FAQ states that it acts as a controller for its own account and technical information and does not sign DPAs with customers. Data is hosted on Hetzner servers in Germany. It is therefore disclosed as an operational service, not represented as a subprocessor of Customer workspace content. |
| Plus Five Five, Inc. (Resend) | Email delivery for Supabase Auth messages and CueHand account/billing notices sent by Sealed | Account email addresses and authentication or billing-message content. Resend is not used to send Customer quotes, invoices or other workspace communications to clients. | Service provider for Sealed's account-level controller processing, not a subprocessor of Customer workspace content. Resend states that customer data is stored in the United States. Current DPA and subprocessor information: https://resend.com/legal/dpa and https://resend.com/legal/subprocessors. |
| Paddle | Merchant of record for CueHand subscription purchases | Buyer, billing, payment, tax, fraud-prevention and buyer-support information. | Independent controller for its merchant-of-record activities. It is not a processor of Customer workspace content merely because it processes the Customer’s CueHand subscription purchase. |
No Firebase SDK / no third-party analytics: CueHand does not use Firebase Authentication, Analytics, Crashlytics, Firestore or Remote Config. The Android Firebase configuration file is present to enable Expo’s Android push-token integration; CueHand does not directly call FCM. CueHand’s product analytics are first-party records in its own database. No third-party analytics or error-monitoring SDK was identified in the code review.