Subprocessors

To deliver the Services, FlowAcq engages a small set of third-party processors (subprocessors) that handle personal data on our behalf. We remain responsible for their compliance under the Data Processing Addendum. This list may change as our infrastructure evolves; we'll provide notice of material changes as set out in the DPA so you can review them.

Current subprocessors

• Stripe — payment processing (live PSP). Processes transaction and payment metadata. Region: US / EU.
• Supabase — managed PostgreSQL database, authentication, and file storage (including KYB onboarding documents). Processes merchant and user account data, PII, and uploaded documents. Region: EU (to be confirmed by counsel).
• Render — API hosting and managed Redis / Valkey (used for queues, idempotency, and rate limiting). Processes transient operational data. Region: US / EU (to be confirmed by counsel).
• Vercel — web and dashboard hosting at the edge. Processes request metadata. Region: global edge network.
• Resend — transactional email (account notifications and alerts). Processes recipient email addresses and message content. Region: US / EU.

International transfers

Where a subprocessor processes personal data across borders, transfers rely on the safeguards described in the DPA, such as Standard Contractual Clauses where applicable.

Status of this list

Founder / legal decision needed: the exact processing regions, the signed DPAs / Standard Contractual Clauses with each subprocessor, and the authoritative, complete list must be confirmed by counsel before this page is relied upon. The entries above reflect the vendors currently in our stack and are provided as a draft for transparency.

Contact

To ask about a subprocessor or request notice of changes, contact us.

This is a working draft provided for completeness. It will be replaced with finalized, counsel-reviewed terms before launch — please don't rely on it yet.