Sub-processors
Last updated 17 August 2026
These are the third parties that process personal data on our behalf to run the Kokoro HACCP system. We will give notice before adding or replacing any of them.
Current sub-processors
| Provider | What it does | Where data is processed |
|---|---|---|
| Supabase | Database, file storage and authentication — the system of record for checks, photos and accounts | United Kingdom (London) |
| Vercel | Application hosting and content delivery | United States (US East) — requests enter via a London edge, but application code executes in the US |
| Resend | Sending transactional email, including monthly reports and account setup links | European Union (Ireland) |
| Google (Google Workspace) | Our own email mailboxes — correspondence you send us | Global infrastructure; Google offers EU data regions for Workspace |
International transfers
Every branch using the system is in England, but that does not mean the data stays here — what matters is where each provider actually processes it, not where its customers are.
The system of record — the database, files and accounts — is held in the United Kingdom. Email processing runs in the European Union. Application hosting currently executes in the United States, so data passes through the US while pages and reports are generated, even though it is stored in the UK.
For processing outside the UK we rely on the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
We state the region each provider actually processes in, established from response headers and provider dashboards rather than from where the company is headquartered.
What we do not use
We do not use analytics, advertising, error-tracking or session-recording services. The application code calls no third parties other than those listed above.
Questions or notice of changes
To ask about this list, or to be notified when it changes, contact privacy@tortomingo.com.