Subprocessor & Service Provider List
Providers that help Opright host, secure, communicate, map, support, and process payments.
Last updated Content version 2026-09-12.98813a0eEffective September 12, 2026
Opright uses the following providers to deliver the service. Their precise processing depends on the features a workspace uses.
| Provider | Purpose | Information involved |
|---|---|---|
| Supabase | Database, authentication, storage, realtime, and server functions | Account, workspace, customer, employee, file, and operational data |
| Vercel | Web hosting, serverless APIs, deployment, and network delivery | Requests, IP/network data, API payloads, and operational logs |
| Stripe | Opright subscriptions, connected accounts, customer payments, refunds, disputes, and payouts | Business verification, billing, payment, customer, and transaction data |
| Resend | Service and marketing email delivery, inbound replies, and enabled email engagement tracking | Email addresses, message content, delivery/open/click metadata, business outreach records, and related invoice/support details |
| OpenAI | Opright Guide product help and record drafting | Approved help context, or user-provided creation requests and draft fields, including customer contact details entered by the user |
| OpenStreetMap contributors / Nominatim | Map tiles and service-address geocoding | Service address or coordinates, IP/network data, and map request |
| jsDelivr / unpkg | Delivery of browser libraries for requested application and map features | IP/network data and asset requests; no workspace records are included in library URLs |
| Have I Been Pwned | K-anonymous breached-password screening | Only the first five characters of a SHA-1 password hash, never the password or full hash |
| jsDelivr and UNPKG | Delivery of pinned browser libraries | IP/network and browser request metadata |
Independent services opened by users
Google Maps, Apple Maps, Waze, Stripe Dashboard, and other linked services receive information only when a user chooses to open them and act under their own terms. A connected field-service business and Stripe may each act as independent controllers for payment and business-verification information.
Changes
Material additions will be posted here before or when processing begins when practical. DPA customers may raise a reasonable data-protection objection by emailing support@mail.oprightapp.com.