Sub-processors
Last updated 28 July 2026
Running Cinderra means handing some data to other companies — nobody hosts their own database in a cupboard any more. Article 28 of the GDPR requires that list to be public and current. This is it, in full.
01Current sub-processors
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| Supabase | Database, authentication and file storage | Account details, board and card content, uploaded files | European Union |
| Vercel | Application hosting and content delivery | IP address, request metadata, server logs | European Union and United States |
| Sign-in with Google | Email address, name and profile picture, only if you use Google sign-in | United States | |
| PayPal | Subscription payments | Billing details, which PayPal collects directly — we never see a card number | European Union and United States |
Each of them processes personal data only on our documented instructions, under a written agreement meeting the requirements of Article 28, and each is bound to confidentiality and to appropriate security measures.
- Supabase — privacy policy: https://supabase.com/privacy
- Vercel — privacy policy: https://vercel.com/legal/privacy-policy
- Google — privacy policy: https://policies.google.com/privacy
- PayPal — privacy policy: https://www.paypal.com/uk/legalhub/privacy-full
02What is not on the list
There is no analytics provider, no advertising network, no session recording, no customer data platform, no AI vendor, and no email marketing tool. If one of those is ever added it goes on this page before it goes into the product.
03Changes
We will give 30 days’ notice before adding or replacing a sub-processor, by updating this page and emailing customers on paid plans.
If you are a business customer with a data processing agreement in place and you object to a new sub-processor on reasonable data protection grounds, write to admin@northem.no within those 30 days. We will try to find another way to provide the service; if we cannot, you may terminate and receive a refund for the unused part of your term.
04A note on where things sit
Board content, uploaded files and account records live in the European Union. The pieces that touch the United States are the content delivery edge in front of the application, and Google sign-in if you choose to use it. Both are covered in the transfers section of the Privacy Policy.
In short
Four companies touch your data, all under Article 28 agreements, and you get 30 days’ notice before that list changes.
- The listSupabase for the database and files, Vercel for hosting, Google for sign-in if you use it, PayPal for subscriptions. That is all of them.
- Not on itNo analytics, no ad network, no session recording, no AI vendor, no email marketing. Adding any of them means updating this page first.
- WhereBoards, files and accounts in the EU. The US appears only in the delivery edge and Google sign-in.
- Changes30 days’ notice on this page and by email to paid accounts.
- ObjectingBusiness customers with a DPA can object on data protection grounds. If we cannot work around it you may terminate and get the unused part of your term back.
This summary is here to be read, not relied on. It is not part of the Sub-processors and it does not change a word of what is above it — where the two disagree, the document wins.