Sub-processors
Last updated: August 15, 2026 · Operator: TyraTag Inc.
| Provider | Role | Data touched | Location |
|---|---|---|---|
| Twilio Inc. | SMS/voice delivery | Phone numbers, message content, delivery metadata | US |
| Supabase Inc. | Database, auth | Account data; encrypted contact + medical fields | US |
| Vercel Inc. | Hosting/CDN | Request data, rendered pages | US / global edge |
| Shopify Inc. | Commerce/checkout | Order, shipping, payment (card data stays with Shopify) | Canada / US |
| Sentry (Functional Software) | Error monitoring | Technical error data; emails and phone numbers scrubbed best-effort, free-text medical notes not reliably matched | US |
| Upstash Inc. | Rate-limit / spend-guard store | Hashed IP + phone keys (no readable PII) | US |
| PostHog Inc. | Opt-in analytics | Pseudonymous usage events tied to an opaque account ID (never scan pages) | US |
| Cloudflare Inc. | Turnstile bot protection | Visitor IP address, request metadata | US / global |
Each provider above processes data on our behalf under its own published data-processing and security terms. We update this page when the list changes, and we will not add a provider that can touch medical fields without disclosing it here first.
Roles and locations last verified: August 15, 2026.