Subprocessor List
This page lists the third-party service providers (“subprocessors”) that process Customer Content on our behalf to operate The StaffApp™. It is the canonical list referenced in our Data Processing Agreement. We update it here first whenever the list changes.
Current subprocessors
Each of the following providers is contractually bound to use data only for the specific services we engage them for, and may not use Customer Content to train AI models except as noted.
| Subprocessor | Purpose | Data Location |
|---|---|---|
| Supabase Inc. | Primary database, authentication, and object storage | United States (us-east-1) |
| Vercel Inc. | Application hosting, edge compute, and serverless functions | Global edge network (primarily US) |
| Anthropic PBC | Large language model powering the AI DevCoach feature (zero-training commitment for API-submitted data) | United States |
| Deepgram Inc. | Speech-to-text transcription for voice dictation (zero-retention configuration; audio not stored and not used for training) | United States |
| ElevenLabs Inc. | Text-to-speech synthesis for DevCoach voice output, using a licensed custom voice model of Chef Adam M. Lamb. Receives the text of DevCoach AI responses only when a user activates the Listen feature; does not receive user questions. Subject to standard operational log retention (typically ~30 days). Not used for model training on our plan tier. | United States |
| Voyage AI | Text embeddings used by the DevCoach knowledge retrieval (RAG) system | United States |
| Resend, Inc. | Transactional email delivery (account notifications, password resets, billing receipts, check-in reminders) | United States |
| Stripe Inc. | Subscription payment processing and billing | United States |
| DeepL SE | On-demand translation of review text (used only when a user explicitly requests translation) | European Union |
A note on web push notifications
When you opt in to push notifications from the in-app profile settings, delivery uses the Web Push standard via the VAPID protocol (Voluntary Application Server Identification). VAPID is not a vendor — it is a cryptographic protocol we use to sign notifications. Actual delivery is handled by your browser’s push service (such as Google’s FCM for Chrome and Android, Apple’s APNs for Safari and iOS, or Mozilla’s autopush for Firefox), which is part of your browser’s infrastructure rather than a service we engage. No notification content is stored on our servers beyond the metadata described in the Privacy Policy.
Marketing website providers
The following providers support the marketing website at thestaffdevapp.com only. They do not process Customer Content from the application at app.thestaffdevapp.com and are listed for completeness.
| Provider | Purpose | Data Location |
|---|---|---|
| SiteGround Hosting Ltd. | WordPress hosting for the marketing site | United States |
| FluentCRM | Marketing email and lead capture (self-hosted on our WordPress infrastructure, not a third-party service) | On our infrastructure |
How we manage subprocessors
Before engaging any subprocessor, we conduct reasonable due diligence on their security posture, privacy practices, and contractual commitments. Every subprocessor is bound by a written agreement imposing data protection obligations substantially equivalent to those we owe you under the Data Processing Agreement.
When we add or replace a subprocessor that will process Customer Content, we notify Customer Organizations at least 30 days in advance via email, in-app notice, or an update to this page. Customers who have executed a DPA may object to a new subprocessor on reasonable data-protection grounds within 15 days of notice.
Notify me of changes
If you would like to receive email notification when this list is updated, send a message to legal@thestaffdevapp.com with the subject line “Subscribe: Subprocessor Updates” and the email address you want notifications sent to.
Questions
For questions about our subprocessors or to request a copy of the Data Processing Agreement, contact legal@thestaffdevapp.com.
65 Merrimon Avenue, Suite 1153
Asheville, NC 28801
Phone: 828-688-0080
Email: legal@thestaffdevapp.com
Stay Tall & Frosty. Lead from the Heart.