What a subprocessor is
A third party that processes customer personal data on our behalf so we can run Weekwright. Every one of them is bound by a written agreement with data protection obligations no less protective than our DPA, receives only what its function requires, and remains our responsibility to you.
Vendors that never touch customer data — the tools we use to write code, pay invoices, or take notes — are not listed, because they are not subprocessors.
Current subprocessors
| Subprocessor | Purpose | Data shared | Processing location |
|---|---|---|---|
| Supabase | Primary infrastructure: the Postgres database, authentication, realtime, and file storage. | All customer data at rest, including employee records, schedules, notes, and account credentials. | United States (AWS us-east-2) |
| Vercel | Application hosting and content delivery for the web app. | Data in transit as requests are served, plus request logs. No customer data is stored at rest. | United States |
| Stripe | Subscription billing and payment processing. | Billing contact email, company name, plan, and location count. Card details go directly to Stripe and never reach our servers. | United States |
| Anthropic | The Claude API, which powers the AI scheduling features. | Only when an AI feature is invoked: the org context that request needs — employee names, availability, shifts, notes — and the prompt. Anthropic does not train its models on this data. | United States |
| Resend | Transactional email: invitations, notifications, and password resets. | Recipient name and email address, and the content of that message — which may name a shift or a schedule. | United States |
| PostHog | Product analytics: which features are used and where people get stuck. On the public marketing pages only, session replay as well. | User id, email, organization id, and which actions were taken, plus the pages visited with identifiers and access tokens stripped out of the address. On the public pages, a recording of the session — clicks, scrolling and mouse movement, with the contents of every form field masked. Recording stops the moment you enter the app, so it never sees any schedule, employee record, or note. Never the content of schedules, notes, or anything typed to the AI. | United States |
| Sentry | Error monitoring and performance diagnostics, including a replay of the seconds before an error inside the app. | Technical diagnostics when something breaks: stack traces, browser, and the URL with tokens and access codes stripped out. When an error happens inside the app, also a replay of the seconds leading up to it — the layout of the screen and which controls were used, with every piece of text and every form field masked out, so names, hours and notes are never transmitted. Nothing is recorded on a visit that produces no error. | United States |
| Expo | Push notification delivery for the mobile app, forwarding to Apple and Google. | A device push token, and the notification text itself — which can include a team member's name and their scheduled or worked hours. No email, no pay rate, and nothing beyond the one line shown on the lock screen. | United States |
| Microsoft Clarity | Heatmaps and session replay for the public marketing pages, to see which parts of a page get read and where people give up. | Page interactions on the public site only — clicks, scrolling, and mouse movement, with the browser and approximate location. It is not loaded once you sign in, so it never sees any schedule, employee record, or note. | United States |
| Google Ads | Advertising measurement: whether a paid ad click ended in a signup, so we know which ads are worth running. | Two events on the public site and at checkout, each carrying the id of the ad click and an opaque reference we generate. No name, no email, no account content — and personalised advertising is switched off, so it cannot be used to build a profile or follow you elsewhere. | United States |
| Microsoft Advertising | Advertising measurement for the Bing campaign: whether a paid ad click ended in a signup, so we know which ads are worth running. | Two events on the public site and at checkout, each carrying the id of the ad click and, for a purchase, the amount. No name, no email, no account content. | United States |
Where the data sits
All of them process in the United States. Your data at rest lives in one place — the Supabase database in AWS us-east-2 — and the rest see a slice in transit or a narrow category. Analytics and error monitoring never receive the content of your schedules, your notes, or anything you type to the AI.
Transfers out of the EEA and the UK are covered by the Standard Contractual Clauses and the UK Addendum; see DPA §8 for the mechanism and Privacy Policy §7 for the plain-language version, including its limits.
Changes
We give at least 30 days' notice before a new subprocessor begins processing customer data. Notice goes by email to organization owners, and this page is updated at the same time.
If you object on reasonable data protection grounds within that window, write to privacy@weekwright.com and we will look for an alternative. If there is none, you may terminate the affected part of the service and get back the unused portion of your prepaid term — the remedy is in DPA §5.
Questions
Vendor reviews, security questionnaires, and requests for a countersigned DPA go to privacy@weekwright.com.