Appendix A — Sub-processors
As of the Effective Date of this DPA, Rad Dad Labs engages the following Sub-processors:
| # | Sub-processor | Function | Type of Personal Data Processed | Region | Status |
|---|---|---|---|---|---|
| 1 | Vercel, Inc. (San Francisco, CA) | Application hosting, edge delivery, build infrastructure | Account, product, barcode, permit, and access log data; transmitted via TLS | United States | Active |
| 2 | Supabase, Inc. (San Francisco, CA) | Primary database, object storage (including any uploaded COA PDF or permit document), authentication | All Personal Data described in Section 2.7 | United States | Active |
| 3 | Stripe, Inc. (South San Francisco, CA) — Rad Dad Labs Stripe account acct_1TPleSKIdVuYBLq3 |
Payment processing; subscription billing; invoicing | Account administrator name and email; billing address; payment method tokens; transaction history. Card numbers and CVV are not transmitted to or stored by Rad Dad Labs. | United States | Active |
| 4 | Resend, Inc. (San Francisco, CA) | Transactional email, alert email, recall notification email delivery | Recipient email address; message content as configured by the Service | United States | Active |
| 5 | Cloudflare, Inc. (San Francisco, CA) | Edge cache, DDoS mitigation, WAF, optionally TLS termination | Truncated source IP, user agent, request metadata for routed requests | United States | Pending — engagement in queue; will be activated upon contract execution and DNS cutover |
This Appendix A is the current authoritative list. The list may also be published at raddadlabs.com/sub-processors. In the event of conflict between this Appendix A and the published page, this Appendix A controls. Customer can subscribe to notice of changes per Section 3.2.