What a subprocessor is
A third party that processes customer personal data on our behalf so we can run Weekwright. Every one of them is bound by a written agreement with data protection obligations no less protective than our DPA, receives only what its function requires, and remains our responsibility to you.
Vendors that never touch customer data — the tools we use to write code, pay invoices, or take notes — are not listed, because they are not subprocessors.
Current subprocessors
| Subprocessor | Purpose | Data shared | Processing location |
|---|---|---|---|
| Supabase | Primary infrastructure: the Postgres database, authentication, realtime, and file storage. | All customer data at rest, including employee records, schedules, notes, and account credentials. | United States (AWS us-east-2) |
| Vercel | Application hosting and content delivery for the web app. | Data in transit as requests are served, plus request logs. No customer data is stored at rest. | United States |
| Stripe | Subscription billing and payment processing. | Billing contact email, company name, plan, and location count. Card details go directly to Stripe and never reach our servers. | United States |
| Anthropic | The Claude API, which powers the AI scheduling features. | Only when an AI feature is invoked: the org context that request needs — employee names, availability, shifts, notes — and the prompt. Anthropic does not train its models on this data. | United States |
| Resend | Transactional email: invitations, notifications, and password resets. | Recipient name and email address, and the content of that message — which may name a shift or a schedule. | United States |
| PostHog | Product analytics: which features are used and where people get stuck. | User id, email, organization id, and which actions were taken. Never the content of schedules, notes, or anything typed to the AI. | United States |
| Sentry | Error monitoring and performance diagnostics. | Technical diagnostics when something breaks: stack traces, browser, and the URL with tokens and access codes stripped out. | United States |
Where the data sits
All of them process in the United States. Your data at rest lives in one place — the Supabase database in AWS us-east-2 — and the rest see a slice in transit or a narrow category. Analytics and error monitoring never receive the content of your schedules, your notes, or anything you type to the AI.
Transfers out of the EEA and the UK are covered by the Standard Contractual Clauses and the UK Addendum; see DPA §8 for the mechanism and Privacy Policy §7 for the plain-language version, including its limits.
Changes
We give at least 30 days' notice before a new subprocessor begins processing customer data. Notice goes by email to organization owners, and this page is updated at the same time.
If you object on reasonable data protection grounds within that window, write to privacy@weekwright.com and we will look for an alternative. If there is none, you may terminate the affected part of the service and get back the unused portion of your prepaid term — the remedy is in DPA §5.
Questions
Vendor reviews, security questionnaires, and requests for a countersigned DPA go to privacy@weekwright.com.