Sub-processors
Effective date: October 30, 2026
Who processes your data
Vextara uses the third-party providers below to run the service. Each acts as a processor on our behalf and is bound by contractual data-protection terms that limit its use of personal data to providing its service to us, with data-processing agreements in place where the law requires them. We do not sell personal data.
For questions about a provider or the data-protection terms that apply, contact privacy@govextara.com.
Current sub-processors
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Supabase | Database, authentication, and file storage | Account, intake, assessment, and care data; uploaded files | Hosted on Amazon Web Services |
| Vercel | Application hosting and content delivery | Request metadata and operational logs (no health data in logs) | United States / global edge |
| Stripe | Payment processing for the assessment fee | Payment card and billing details, handled entirely by Stripe | United States |
| Resend | Account and reminder email delivery | Email address and message content (emails never include health details) | United States / Europe |
| OpenAI | Optional AI features (Ollie copilot, content matching) — only when switched on | Parent messages and limited child context (first name, age, subtype) | United States |
| Google (Analytics & Ads) | Website analytics (GA4) and advertising measurement, via Google Tag Manager — cookies only with your consent (Google Consent Mode) | Cookie / device identifiers and usage events (never health data; cookies set only after you accept) | United States / global |
Changes
We’ll update this page when we add or remove a sub-processor. Material changes affecting how personal data is processed will be reflected in the Privacy Policy and, where required, notified to you.