Sub-processors
Last updated Nov 4, 2026
The providers that process personal data for MinsoBill: what each one does, which data, where, and on what basis.
| Provider | Purpose | Data | Location | Transfer basis | DPA |
|---|---|---|---|---|---|
| Supabase | Database, sign-in and file storage | All account and business data: names, email addresses, business and client details, invoices, payments, logos | United States (us-east-1) | Standard Contractual Clauses and the UK Addendum, in the Supabase DPA | Supabase DPA (opens the provider's site) |
| Vercel | Hosting and running the app | Everything shown in the app passes through it; request logs with IP addresses | United States (iad1) | EU–US Data Privacy Framework and UK Extension | Vercel DPA (opens the provider's site) |
| Resend | Sending invoice, reminder and account emails | Recipient email addresses, email content and attachments, delivery events | Sent from the EU (Ireland, eu-west-1); Resend is a US company | EU–US Data Privacy Framework and UK Extension | Resend DPA (opens the provider's site) |
| AnthropicOnly when you use AI quick-create | AI quick-create: turning typed text into a draft invoice | The text you type, today's date, your base currency and locale | United States | Standard Contractual Clauses and the UK Addendum, in the Anthropic DPA | Anthropic DPA (opens the provider's site) |
| StripeOnly for businesses that connect their own Stripe account | Card payments on the business's own Stripe account | Invoice number, amount and business name; card and payer details are entered on Stripe and never reach MinsoBill | United States and other Stripe locations | EU–US Data Privacy Framework and UK Extension; Stripe's Data Transfers Addendum | Stripe DPA (opens the provider's site) |
| CloudflareFrom Nov 4, 2026 | Encrypted offsite backup copies (R2 storage) | Encrypted database backups. Cloudflare cannot read them: they are encrypted before they leave our systems | European Union (R2 EU jurisdiction) | EU–US Data Privacy Framework and UK Extension, in the Cloudflare DPA | Cloudflare DPA (opens the provider's site) |
| Support mailbox: emails to support@minsobill.com are forwarded to Gmail | Emails you send to support and our replies | United States and other Google locations | EU–US Data Privacy Framework and UK Extension (Google LLC) | Google DPA (opens the provider's site) |
New sub-processors
We give at least 30 days' notice on this page before any new sub-processor starts, with the date it starts. Business customers can object as described in our data processing agreement.
Transfers out of the UK and the EU
Where a provider is certified under the EU–US Data Privacy Framework and its UK Extension, we rely on that. Otherwise we rely on the EU Standard Contractual Clauses, with the UK Addendum or the UK IDTA for UK data. More in our privacy notice.