Sub-processors
The third parties Custilo uses to deliver the service, what each is used for, which personal data it can see and where.
Last updated: 3 October 2026
Draft
This text is a draft that is being reviewed and may still change. Values in square brackets are still to be completed. Questions: hello@custilo.com.
Sub-processors of customer data
These providers process personal data on behalf of our customers, under our data processing agreement (this list is its Annex 3). Each is bound by a data processing agreement. Where data is processed outside the European Economic Area, the transfer is covered by an adequacy decision (such as the EU-U.S. Data Privacy Framework for certified providers) or by the European Commission’s Standard Contractual Clauses.
| Provider | Used for | Personal data it processes | Location |
|---|---|---|---|
| Supabase Inc. | Database and authentication | All Customer Personal Data stored in Custilo | European Union (Ireland) |
| Vercel Inc. | Hosting of the application and scheduled jobs | Data passing through the application, request metadata and logs | Ireland (application functions); United States (Vercel Inc.) |
| Resend (Plus Five Five, Inc.) | Sending feedback, alert and notice emails | Recipient email addresses and email content | [United States or EU region, to confirm] |
| Reoon | Checking that an email address exists before sending (some plans and free trials only) | Customer email addresses | Bangladesh (no adequacy decision; Standard Contractual Clauses and a transfer impact assessment [to be concluded]) |
| Functional Software, Inc. (Sentry) | Error monitoring | Error details and page addresses, with secret links, IP addresses and cookies removed before sending | [United States or EU region, to confirm] |
Other providers
Our payment provider processes the billing data of our customers for us and for its own legal obligations. It does not receive the data of our customers’ customers.
| Provider | Used for | Personal data it processes | Location |
|---|---|---|---|
| Stripe Payments Europe, Ltd. | Subscriptions, invoicing and payments | Name, email, billing details and payment details of the paying business | Ireland and United States |
Changes
We inform customers by email at least 30 days before we add or replace a sub-processor, and they can object as described in the data processing agreement.