Active third parties in the data-processing stack
Subprocessors
Last updated: November 2, 2026
The following third-party service providers process personal data as part of the Trailmaker platform. Changes are announced to existing customers at least 30 days in advance by email (see DPA §6).
TABLE SCROLLS SIDEWAYS →
| Name | Purpose | Region | Transfer mechanism | Legal docs |
|---|---|---|---|---|
| Supabase (Inc.) | Postgres database, authentication, realtime, edge functions, storage | USA (AWS us-east-1, N. Virginia) — the production database is not hosted in the EU | Standard Contractual Clauses (SCC, 2021) + TIA | Documents |
| Vercel (Inc.) | Frontend hosting (Next.js), edge CDN, serverless API routes | USA (iad1, Washington, D.C.) for server functions; global CDN for static assets | Certified under EU-US Data Privacy Framework (DPF) | Documents |
| Google Cloud (Google Ireland Limited) | Engine hosting on Cloud Run | USA (us-east4) | Certified under EU-US Data Privacy Framework (DPF) | Documents |
| Anthropic (PBC) | Claude (Sonnet for strategy outputs, Haiku for lightweight tasks such as routing, column matching and hook checks) — prompt + completion | USA | Standard Contractual Clauses (SCC, 2021) + TIA | Documents |
| Stripe (Payments Europe Limited) | Billing, payment processing, invoicing, webhooks | EU (Ireland) | Certified under EU-US Data Privacy Framework (DPF) | Documents |
| Resend (Resend, Inc.) | Transactional + onboarding emails (welcome, day-3 check-in, day-6 conversion). Supabase auth emails run separately. | Sending region EU (Ireland, eu-west-1); Resend, Inc. is a US company and its primary processing takes place in the USA | DPF + SCC fallback | Documents |
| Meta Platforms Ireland Limited | Meta Pixel + Conversions API (ad attribution, conversion tracking, custom-audience building). Loaded only after consent in the consent banner. Processes IP, user agent, _fbp/_fbc cookies, and for logged-in users hashed identifiers (email, external user ID, name, country from billing data). | EU (Ireland) as contracting party; data export to Meta Platforms, Inc. (USA, parent company) | DPF + SCC fallback | Documents |
| Google Ireland Limited (Google sign-in) | Identity provider for the optional "Continue with Google" sign-in and registration. Sends e-mail address, verification status, name and Google account ID to us via Supabase Auth; only used if you choose Google sign-in. | EU (Ireland) as contracting party; data export to Google LLC (USA, parent company) | Certified under EU-US Data Privacy Framework (DPF) | Documents |
| PostHog (PostHog, Inc.) | Product analytics (identified users only). Session replay is disabled. Loaded only after consent in the consent banner. | USA (us.posthog.com) | Standard Contractual Clauses (SCC, 2021) + TIA | Documents |
| Firecrawl (SideGuide Technologies, Inc. d/b/a Firecrawl) | Website reader in Cairn: fetches the public pages of the brand websites you enter (page content, HTML and a screenshot of the public page) and returns them to us. Processes public website content and the web addresses you enter; no account data is sent. | USA (Firecrawl states that its servers are located in the United States) | No transfer mechanism or DPA published by the provider; only public website content is sent | Documents |
| Sentry (Functional Software, Inc.) | Error and performance monitoring (stack traces, anonymized request data — sendDefaultPii=false, header scrub on authorization/cookie/set-cookie). | USA (Sentry Cloud) | Certified under EU-US Data Privacy Framework (DPF) | Documents |
Changes
When we add new subprocessors or replace existing ones, we notify existing customers by email at least 30 days before they take effect (see DPA §6). In this case the Customer has an extraordinary right of termination if the replacement would be unreasonable for them.