Draft — not legally reviewed
This is a working draft prepared for review. It has not been checked by a legal practitioner and must not be relied on as it stands. It is published so it can be reviewed, not because it is finished.
Subprocessors
Last updated 15 September 2026
Who processes data on our behalf
These are the services Our POS depends on. We add to this list only when it is necessary to run the service.
| Provider | Purpose | Location | Data involved |
|---|---|---|---|
| Vercel | Application hosting and content delivery | Cape Town region (cpt1), with global edge | Requests, logs, session cookies |
| Neon | Managed PostgreSQL database | Confirm region at provisioning | All business and trading data |
| Peach Payments | Subscription card collection, and in-store card acceptance where used | South Africa | Billing contact, card token. Card numbers are entered on Peach's own page and never reach us |
| Optional sign-in | Global | Name, email address, account identifier. No mailbox access is requested |
Not yet engaged
No email delivery provider is engaged yet, so invitation links are shown on screen rather than sent. No SMS provider and no analytics provider is engaged.
Still to be settled before this is finished
Signed data-processing agreements with each provider; confirmed hosting regions and the cross-border transfer basis for each; and how customers are notified before a new subprocessor is added.