The following subprocessors are engaged in the delivery of the Service to all Customers.
| Subprocessor | Processing performed | Location |
|---|---|---|
| Supabase | Primary database, authentication and workspace file storage (photos, receipts, logos, documents) for Customer Data, and the provider’s own point-in-time database snapshots. | United States — Amazon Web Services, region us-east-1 |
| Cloudflare | Application and website delivery, DNS, serverless function execution including the AI-assisted features, PDF generation and storage of generated documents, object storage of file-transfer files (R2, Eastern North America location hint), and inbound email routing. Also provides an aggregate page-performance measurement that sets no cookie and stores nothing on the visitor’s device. | United States entity; global delivery network |
| Stripe, Inc. | Subscription payment processing and, where enabled by the Customer, online invoice payment. Cardholder data is processed by Stripe and is not received by MIXEL INC. | United States |
| Resend | Transmission of outbound email sent by the Service on a Customer’s behalf, including file-transfer deliveries and their download, reply and reminder notices, and receipt of inbound replies routed back to the originating workspace. | United States |
| GitHub, Inc. | Runs the nightly backup job: the database and stored files are captured, encrypted and verified on GitHub’s hosted runners before the ciphertext is sent to Google Drive. The backup key is held in GitHub’s encrypted secret store. | United States |
| Google LLC (Gmail) | Receipt of messages sent through the KitSlate contact form and waitlist notices, at MIXEL INC’s own mailbox. | United States |
| Komoot GmbH (Photon) | Address suggestions and map-link lookups: the address text a user types is sent to look up matching places. | Germany |
| Zippopotam.us | Postcode lookups: a postcode and country a user types are sent to fill in the town. | United States |
| Google LLC (Google Drive) | Storage of the encrypted off-site backup copies of Customer Data described on the Security page. Backups are encrypted by MIXEL INC before transfer; Google stores only ciphertext and holds no decryption key. This is MIXEL INC’s own storage and is separate from any Google account belonging to a Customer. | United States |
The following subprocessors receive personal information only where a Customer uses the associated feature.
| Subprocessor | Processing performed | Location |
|---|---|---|
| Anthropic PBC | Interpretation of material submitted by a user to an AI-assisted feature — receipt and document reading, catalogue matching, import column mapping and drafting assistance. Transmission occurs on invocation of the feature, or when a receipt arrives at a workspace’s receipts address, and is limited to the item submitted, plus client, crew and equipment names when drafting a production. Under Anthropic’s commercial API terms, inputs and outputs are not used to train its models. | United States |
| Google LLC (Cloud Vision) | A reverse-image check of marketplace listing photos, run by MIXEL INC when reviewing a listing. | United States |
| Google LLC | Authentication, only where a user elects to sign in with Google; and, only where a user connects Google Calendar under Privacy Policy section 5, the receipt of that user’s KitSlate bookings as calendar events written to the Google calendar the user chose. Google processes those events under its own terms as the user’s calendar provider. MIXEL INC receives the user’s name, email address and profile picture, and accesses no other Google service. | United States |
No subprocessor listed on this page is authorised to process personal information for its own purposes, to disclose it to a further party except as necessary to deliver its service to MIXEL INC, or to use it for advertising. MIXEL INC does not sell personal information, does not share it for cross-context behavioural advertising, and does not disclose it to data brokers. No subprocessor is authorised to use Customer Data to train machine-learning models.
MIXEL INC maintains this page as the current record of its subprocessors and updates it before engaging a new subprocessor that processes personal information. Customers who wish to be notified of changes may register a contact address by writing to [email protected], and will receive notice of an intended addition or replacement in advance of engagement.
A Customer may object to a proposed subprocessor on reasonable data-protection grounds by writing to the same address. Where an objection cannot be resolved, the Customer may terminate the affected portion of the Service in accordance with Section 28 of the Terms & Conditions.
Questions regarding this register, or requests for further information about a listed subprocessor, may be directed to [email protected].
MIXEL INC
a New York corporation, doing business as KitSlate
State of New York, United States
[email protected] · kitslate.app