Sub-processors
Every third party that can touch customer data, what it does and where. We tell you before this list grows.
Version 1.0, effective October 11, 2026. Replaces the version of September 30, 2026.
Current sub-processors
These are the third parties that can process customer data in the course of delivering usellit. Each is bound by terms no less protective than our DPA.
| Provider | What it does | Data it can touch | Location |
|---|---|---|---|
| Supabase | Managed Postgres database and authentication | All application data, account credentials | United States |
| Render | Application hosting and static site hosting | Data in transit, server logs | United States |
| Resend | Transactional email - sign-up confirmation, password reset | Email address, name | United States |
| OpenAI | The AI behind Spark AI and in-product help | The question asked and the records it is about - items, customers, sales and postings - for the moment it takes to answer | United States |
| Sent | Text message receipts, where a store switches them on | The phone number a receipt is sent to, and the receipt | United States |
| Stripe | Subscription billing for usellit itself, and card payments at the counter where a store uses Stripe | Billing contact, company name, plan and invoices; the amount and result of a sale. Card details go to Stripe directly and never reach usellit | United States |
| Square | Card payments at the counter, where a store uses Square | The amount and result of a sale. Card details go to Square directly and never reach usellit | United States |
Not sub-processors
Worth stating, because they are the systems people ask about:
- Oracle NetSuite and QuickBooks Online (Intuit) are your systems, not ours. We connect to them on your instruction with credentials you provide. We are not their processor and they are not ours.
- Payment providers at the counter - Stripe and Square - receive cardholder data directly from the payment terminal. That data never reaches usellit, so for card payments they act as independent controllers rather than as our sub-processors. Stripe also bills us for usellit subscriptions, which is why it appears in the table above for that alone.
Changes
This page is updated when a sub-processor is added, and you may object on reasonable data protection grounds - see section 4 of the DPA. To be told when this page changes, ask through the contact form.