Subprocessors
To operate PolicyWallet we work with a limited number of technical providers that process personal data on our behalf (subprocessors). This page lists who they are, what role they play, what data they touch, and where they process it.
1. Subprocessors list
Current as of the last-updated date shown at the top of this page:
| Provider | Role | Data | Processing location |
|---|---|---|---|
| Supabase | Database, authentication, file storage | Account data, insurance policy documents, application data | EU — eu-west-3 (Paris, France) |
| Vercel | Application hosting and content delivery network (CDN) | Traffic data, technical logs | EU/US (global network) |
| Stripe | Payment and subscription processing | Billing and subscription details; card data is held exclusively by Stripe | EU/US |
| Brevo | Email delivery (notifications, newsletter) | Email address, name, notification content | EU (France) |
| Upstash | Request rate limiting (Redis) | Per-IP request counters — no document content | EU/US |
| Google (Gemini API) | AI document analysis — primary provider | Policy content submitted for analysis, only with your consent | EU/US |
| Google (Google Analytics) | Usage analytics | Aggregate usage events with IP anonymisation — only if you accept the "Analytics" category | EU/US |
| Anthropic | AI document analysis — alternate provider | Policy content submitted for analysis, only with your consent | US |
| OpenAI | AI document analysis — alternate provider | Policy content submitted for analysis, only with your consent | US |
2. Safeguards
Every subprocessor is bound by a data processing agreement under Article 28 GDPR and processes only the data its role requires.
For providers processing data outside the European Economic Area, transfers are covered by the EU-U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.
The AI providers' data-processing terms do not permit the use of your data to train their models.
3. Updates to this list
Before adding a new subprocessor or materially changing an existing one's role, we update this page and the date at its top.