Subprocessors

Article 13(1)(e) of the GDPR requires us to tell you who receives your personal data. This is that list, kept separate from the Privacy Policy so it can be updated when a provider changes without reissuing the whole policy.

Each provider below processes personal data on our instructions only, under a data processing agreement, and may not use it for its own purposes.

We do not sell personal data and we share nothing for advertising.

Supabase — database, sign-in, and file storage. Processes essentially everything described in our Privacy Policy: account details, orders, intake answers, uploaded documents, reports, messages, comments.
Processing location: European Union. Supabase is a US-incorporated company, so its support and operations staff may in principle access data from outside the EEA; that possibility is covered by Standard Contractual Clauses.

Vercel Inc. — hosting and content delivery for the website itself. Processes network addresses, browser identification and the pages requested, as an unavoidable part of serving a page. Also provides aggregate traffic and performance measurement, which sets no cookie and stores nothing on your device.
Processing location: global edge network; transfers rest on Standard Contractual Clauses.

Stripe — payment processing, tax calculation and invoicing. Receives your name, email address, billing address, VAT number where you give one, and the amount and currency of your order. Card details go directly to Stripe and never reach our systems.

Stripe acts as our processor for the checkout and as an independent controller for its own fraud-prevention and regulatory obligations, which it explains in its own privacy policy.
Processing location: European Union and United States; transfers rest on Standard Contractual Clauses.

Resend — sending transactional and newsletter email. Receives the recipient address, the name where used, and the full content of the message — which for an order confirmation includes what you bought, and for a support reply includes what was discussed.

Resend also reports delivery, bounce, open and click events back to us. See the Privacy Policy for what we do with those.
Processing location: United States; transfers rest on Standard Contractual Clauses.

PostHog — product analytics and session recording, on its European Union infrastructure. Receives your account identifier if you are signed in, never your name or email address, plus pages visited and actions taken.

Nothing reaches PostHog unless you have accepted analytics cookies. Without consent the software is not even downloaded to your browser.
Processing location: European Union.

Google — where you choose to sign in with Google. Google tells us your name and email address; we never receive your Google password. Your use of Google's own service is governed by Google's privacy policy, not ours.
Processing location: global; transfers rest on Standard Contractual Clauses.

Signing in with Google is optional. Email and password works identically.

Upstash — short-term counters that stop password guessing and spam. Holds a network address, or the email address used for a sign-in or password-reset attempt, for between 5 minutes and 1 hour. Nothing else, and never joined to an account.
Processing location: European Union. Upstash is a US-incorporated company; as with our database provider, any access from outside the EEA is covered by Standard Contractual Clauses.

Listed for completeness, because they are part of how the site works even though your personal data does not reach them.

Anthropic — used by an administrator to translate our own marketing text from English into Spanish. It receives website copy. No customer data, no intake answers and no report content is sent to it.

Google Search Console — reports how our pages appear in search results. We send Google our own web address; we receive aggregate statistics. No visitor data goes to it from us.

This page carries a version number and an effective date. When we add or replace a provider we publish the change here first.

If you object to a specific provider, write to info@dominicanvest.com. We will tell you honestly whether the service can be delivered without it.