Offline

Subprocessor Register

Annex III to the Data Processing Addendum.

Last updated: 20 February 2026. Last subprocessor change: 20 February 2026 (register first published).

Subprocessor	Purpose	Data processed	Processing location	Transfer mechanism
Supabase (managed hosting, database, authentication, storage, edge functions)	Primary hosting of the production database, user authentication, document storage and server-side functions.	All Customer Personal Data stored in the Platform.	Amazon Web Services Europe (Ireland), eu-west-1. Provider corporate operations may be outside the UK/EEA.	Data at rest remains in the EEA. Provider support access from outside the UK/EEA is covered by the provider's SCC-based data processing terms.
Lovable (platform infrastructure and AI gateway)	Application hosting and delivery, and routing of AI requests made by the Platform to model providers.	Application traffic; content submitted for AI processing (see AI subprocessors below).	European Union / United States.	Covered by the provider's data processing terms incorporating Standard Contractual Clauses. Mechanism to be reconfirmed in writing at next review.
Google (Gemini models, accessed via the AI gateway)	Automated reading, classification and extraction of data from documents uploaded by the Customer, and in-app assistance features.	Content of submitted documents and prompts, which may include identity, certificate, medical certificate, contract, financial and travel data.	European Union / United States.	Standard Contractual Clauses plus UK Addendum via the provider's data processing terms. Content submitted through the API is not used for model training.
OpenAI	Secondary AI model provider for document extraction and assistance features where configured.	Content of submitted documents and prompts.	United States / European Union.	Standard Contractual Clauses plus UK Addendum via the provider's API data processing addendum. API content is not used for model training.
xAI	Secondary AI model provider used for specific assistance and extraction features where configured.	Content of submitted documents and prompts.	United States.	Standard Contractual Clauses plus UK Addendum via the provider's terms. Mechanism to be reconfirmed in writing at next review.
Resend	Delivery of transactional and notification email (invitations, alerts, approvals, compliance notifications).	Recipient name and email address, and the content of the notification, which may reference crew names, vessel, dates and the subject of the notification.	United States, with EU sending region where configured.	Standard Contractual Clauses plus UK Addendum via the provider's DPA.
Stripe	Subscription billing and payment processing.	Billing contact details, subscription and payment records. Card data is collected and held by Stripe; we do not store card numbers.	United States / European Union / Ireland.	Standard Contractual Clauses plus UK Addendum via Stripe's DPA. Stripe acts as an independent controller for certain payment and fraud-prevention purposes.
Firecrawl	Automated retrieval of publicly available certificate verification results from maritime authority websites (for example MCA Certificate of Competency verification).	Certificate number, holder name and date of birth as required to perform the public verification lookup.	United States.	Standard Contractual Clauses plus UK Addendum. Mechanism to be reconfirmed in writing at next review.

Notes

The production database, authentication service and all document storage are hosted in the Amazon Web Services Europe (Ireland) region, eu-west-1.
AI subprocessors receive only the content submitted for a specific extraction or assistance request. Content submitted through the Platform is not used to train our models, and we do not permit its use to train the providers' models.
Where a transfer mechanism is marked "to be reconfirmed", the transfer is made under the provider's published data processing terms and we are confirming the current documented mechanism directly with the provider.

Change notification and objection

We give at least thirty (30) days' notice before a new or replacement subprocessor begins processing customer personal data, by updating this register and notifying the customer's registered administrative contact. Customers may object on reasonable data protection grounds within fourteen (14) days, and may subscribe to change notifications, by emailing info@yachtwatchkeeper.com. The objection process is set out in section 9 of the DPA.