Legal
Sub-processors
Last updated 28 July 2026
Running CanvasFlow means handing some data to other companies — nobody hosts their own database in a cupboard any more. Article 28 of the GDPR requires that list to be public and current. This is it, in full.
Current sub-processors
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| Supabase | Database, authentication and file storage | Account details, board and card content, uploaded files | European Union |
| Vercel | Application hosting and content delivery | IP address, request metadata, server logs | European Union and United States |
| Sign-in with Google | Email address, name and profile picture, only if you use Google sign-in | United States | |
| PayPal | Subscription payments | Billing details, which PayPal collects directly — we never see a card number | European Union and United States |
Each of them processes personal data only on our documented instructions, under a written agreement meeting the requirements of Article 28, and each is bound to confidentiality and to appropriate security measures.
- Supabase — privacy policy: https://supabase.com/privacy
- Vercel — privacy policy: https://vercel.com/legal/privacy-policy
- Google — privacy policy: https://policies.google.com/privacy
- PayPal — privacy policy: https://www.paypal.com/uk/legalhub/privacy-full
What is not on the list
There is no analytics provider, no advertising network, no session recording, no customer data platform, no AI vendor, and no email marketing tool. If one of those is ever added it goes on this page before it goes into the product.
Changes
We will give 30 days’ notice before adding or replacing a sub-processor, by updating this page and emailing customers on paid plans.
If you are a business customer with a data processing agreement in place and you object to a new sub-processor on reasonable data protection grounds, write to admin@northem.no within those 30 days. We will try to find another way to provide the service; if we cannot, you may terminate and receive a refund for the unused part of your term.
A note on where things sit
Board content, uploaded files and account records live in the European Union. The pieces that touch the United States are the content delivery edge in front of the application, and Google sign-in if you choose to use it. Both are covered in the transfers section of the Privacy Policy.