Distinct-app
Subprocessors
Last updated: 10 September 2026
The table below lists the service providers we use to run the platform: what each one does, what categories of data it can access, where it processes or stores that data, and the data processing terms that govern it.
| Provider | Purpose | Data categories | Data processing / hosting location | DPA status |
|---|---|---|---|---|
| Supabase | Database, authentication, file storage for most apps | Account data, business data, bookings, files | eu-north-1 (AWS Stockholm, Sweden) | Supabase Data Processing Addendum (standard terms) |
| Vercel | Application hosting for most apps | All data transiting the hosted app | us-east-1 (Washington, D.C., USA) | Vercel Data Processing Addendum (standard terms) |
| Cloudflare | DNS, object storage (R2), hosting for some apps, inbound email routing, and AI inference (Workers AI) as a fallback provider for the in-app AI assistant | Uploaded files/photos; DNS traffic metadata; inbound email metadata; AI prompt text and the app data retrieved to answer it | Global network; the shared R2 storage bucket is located in Western Europe | Cloudflare Data Processing Addendum (standard terms) |
| Anthropic, PBC | AI inference for the in-app AI assistant (primary provider), where the assistant is enabled | The user's question text and the business/account data retrieved to answer it. Sent via Anthropic's API, which is not used to train models by default. | United States | Anthropic Commercial Terms / Data Processing Addendum (standard terms) |
| Google LLC | "Sign in with Google" authentication (via Supabase Auth), and AI inference (Gemini API) for the in-app AI assistant and for content generation in Flyer Buddy / Logo Maker Genie, where enabled | For sign-in: name, email address, profile picture. For AI: prompt text and the business/account data retrieved to answer it. Paid Gemini API usage is not used to train models. | United States and other locations where Google operates | Google Cloud / Workspace Data Processing terms (standard terms) |
| GitHub, Inc. (Microsoft) | Source-code hosting and CI/CD (GitHub Actions), including automated security and quality scans of our own code and deployments | Application source code, deployment logs, and CI configuration. No customer personal information is intentionally sent; end-user data is not stored in the repositories. | United States | GitHub Data Protection Agreement (standard terms) |
| Paystack South Africa (Pty) Ltd | Payment processing, transaction management and related payment services for Distinct-app subscriptions and for Paystack-enabled in-app transactions | Customer identification/contact information, transaction information, and payment data necessary to process the transaction. Distinct-app does not receive or store full card details where those details are collected directly by Paystack. | South Africa and other jurisdictions used in Paystack's payment infrastructure | Applicable Paystack merchant agreement and data-processing provisions |
| Resend | Outbound transactional email, where configured | Recipient email address, message content | United States, per Resend's Privacy Policy | Resend Data Processing Addendum (standard terms) |
| sms1.smsmessenger.co.za | Live SMS delivery (Marketing app) | Recipient phone number, message content | South Africa | Governed by the provider's standard service terms |
| Black Forest Labs (FLUX) | AI image generation (Flyer Forge, Logo Maker Genie, Marketing) | Prompt text only, no personal information intentionally sent by us, though a user could enter personal information in a prompt | Not publicly disclosed by the provider; requests are made via its hosted API | Governed by Black Forest Labs' standard API terms |
Not every app uses every provider above. This list is reviewed alongside the platform governance documentation and updated when a new provider is integrated.
We also use software for security scanning, automated testing, and performance and code analysis. These tools run inside our own build pipeline against our own source code and our own running services — they do not receive customer personal information — so they are not listed as subprocessors. The platform that hosts that pipeline (GitHub) is listed above.