Subprocessors
We use external companies for storage, payments, email and other technical services. Below we explain what each provider does and which data it may use. Each company's exact role also depends on the applicable processing agreement.
1. Subprocessors list
Current as of the last-updated date shown at the top of this page:
| Provider | Role | Data | Processing location |
|---|---|---|---|
| Supabase | Database, authentication, file storage | Account data, insurance policy documents, application data | EU — eu-west-3 (Paris, France) |
| Vercel | Application hosting and content delivery network (CDN) | Traffic data, technical logs | EU/US (global network) |
| Stripe | Payment and subscription processing | Billing and subscription details; card data is held exclusively by Stripe | EU/US |
| Brevo | Email delivery (notifications, newsletter) | Email address, name, notification content | EU (France) |
| Upstash | Request rate limiting (Redis) | Per-IP request counters — no document content | EU/US |
| Sentry | Application error monitoring | Technical error events with personal data scrubbed — no document content | EU/US |
| Google (Gemini API) | AI document analysis — primary provider | Policy content submitted for analysis, only with your consent | EU/US |
| Google (Google Analytics) | Usage analytics | Usage events, device information and cookie identifiers — only if you accept the Analytics category | EU/US |
| Anthropic | AI document analysis — alternate provider | Policy content submitted for analysis, only with your consent | US |
| OpenAI | AI document analysis — alternate provider | Policy content submitted for analysis, only with your consent | US |
2. Safeguards
Article 28 GDPR requires an appropriate contract for each provider processing data on our behalf. For information about the specific service, contact dpo@policywallet.gr.
Processing outside the European Economic Area requires a lawful transfer mechanism. You may request provider-specific details and a copy of the relevant safeguards at dpo@policywallet.gr.
AI providers are governed by the terms of the specific API service, which describe data use and retention. The terms of a free chat application are not necessarily the same as those of a commercial API service.
3. Updates to this list
Before adding a new subprocessor or materially changing an existing one's role, we update this page and the date at its top.