Sub-processors
Last updated 22 September 2026
Every third party that can touch customer data, what it does and where. We tell you before this list grows.
Current sub-processors
These are the third parties that can process customer data in the course of delivering usellit. Each is bound by terms no less protective than our DPA.
| Provider | What it does | Data it can touch | Location |
|---|---|---|---|
| Supabase | Managed Postgres database and authentication | All application data, account credentials | United States |
| Render | Application hosting and static site hosting | Data in transit, server logs | United States |
| Resend | Transactional email - sign-up confirmation, password reset | Email address, name | United States |
| OpenAI | The Spark AI features, and the free built-in help - only when somebody uses one | Whatever the question needs: item names and descriptions, a customer's name and their own purchase history, figures already on the screen, or the record of one sale or one import run. Never card numbers, expiry dates, card verification values or the last digits of a card. Not used to train models. | United States |
Not sub-processors
Worth stating, because they are the systems people ask about:
- Oracle NetSuite is your system, not ours. We connect to it on your instruction with credentials you provide. We are not its processor and it is not ours.
- Payment providers - Stripe and Square - receive cardholder data directly from the payment terminal. That data never reaches usellit, so they act as independent controllers for it rather than as our sub-processors. They will appear here if and when they process data on our behalf.
Changes
We give at least 30 days' notice before adding a sub-processor, and you may object on reasonable data protection grounds - see section 4 of the DPA. To be told when this page changes, email support@usellit.ai.