№ 003 · Legal

Sub-processors.

Last updated May 23, 2026

§ 01 · Current sub-processors

The services below process customer data on behalf of Suan Digital LLC, each bound by data-protection terms and processing only on our instructions. Cloud providers you connect to Naew (AWS, GCP, Azure, OpenAI, Anthropic, and so on) are your own vendors, not ours.

01 · Supabase

  • Purpose: Primary database, authentication (magic-link OTP), object storage, edge functions, and encrypted secret vault. Also delivers transactional email for sign-in links and account notifications.
  • Data processed: Account email, organization membership, vendor and charge records, uploaded invoice files, encrypted cloud-provider credentials.
  • Location: United States (AWS regions, managed by Supabase).
  • Privacy policy: supabase.com/privacy

02 · Stripe

  • Purpose: Subscription billing, payment processing, customer portal.
  • Data processed: Org email, organization name, Stripe customer identifier, subscription status, invoice metadata. Card numbers and bank details are handled by Stripe and never touch Naew.
  • Location: United States and Stripe-operated regions.
  • Privacy policy: stripe.com/privacy

03 · Vercel

  • Purpose: Application hosting, edge network, build infrastructure.
  • Data processed: Request metadata (IP, user agent, path) for routing and security; no application database is stored on Vercel.
  • Location: Global edge network; primary build region in the United States.
  • Privacy policy: vercel.com/legal/privacy-policy

04 · Cloudflare

  • Purpose: Turnstile CAPTCHA on the closed-beta signup form.
  • Data processed: Browser challenge tokens, IP address at challenge time. Used only to verify a real human is submitting the form.
  • Location: Global edge network.
  • Privacy policy: www.cloudflare.com/privacypolicy

§ 02 · Notice of changes

Before adding or replacing a sub-processor with access to customer data, we update this page. Customers on a written agreement that requires advance notice receive it by email at least 30 days before the change, with the right to object on reasonable grounds. Questions: [email protected]. Framework: DPA.