BUILD HALT
Sub-processors
Last updated: 2 October 2026
Processing personal data
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Supabase Inc. | Database, file storage, authentication | All application data | Frankfurt, Germany (eu-central-1) |
| Functional Software, Inc. (Sentry) | Crash and error reporting | Diagnostic data, which may incidentally include identifiers | EU region (ingest.de.sentry.io) |
| Geoapify GmbH | Static map images | Workplace coordinates | Germany |
| Apple Inc. | Delivering push notifications; "Sign in with Apple" | Device token and notification text; on sign-in, name and email | United States |
| Google LLC | Delivering push notifications to Android phones (Firebase Cloud Messaging); "Sign in with Google" | Device token and notification text; on sign-in, name and email. No project content | United States |
| Supabase Inc. (built-in mailer) | Sign-up confirmation and password-reset email | Email address | Sending region not guaranteed EU; being moved to IONOS |
| IONOS SE | Support mailbox (support@buildhalt.com); intended sender for transactional email | Email address, name, message content | Germany / United Kingdom |
| Vercel Inc. | Hosting the website and the web app for managers and crew (www.buildhalt.com) | Whatever a signed-in user views or exports in the browser passes through Vercel's servers in transit; nothing is stored there | Frankfurt, Germany (fra1) for server functions; a global edge network only checks the sign-in cookie to route the request |
| Stripe Payments Europe, Ltd | Payment processing for subscriptions | Company name, the paying manager's email and billing address, and the card — entered on Stripe's own page, never passing through Build Halt. No project or worker data | Ireland (Stripe group, United States) |
Speech-to-text is on the device, not a subprocessor
Dictating an end-of-day note uses the speech recogniser built into iOS and Android, configured to run on the handset only. The audio never leaves the phone and no provider receives it.
Not subprocessors
Listed because customers ask, and because the distinction is deliberate.
| Provider | Why not |
|---|---|
| Expo (650 Industries, Inc.) | Build and distribution infrastructure only — source code and signing credentials, not end-user personal data. Expo's push relay is deliberately not used; notifications go direct from our EU infrastructure to Apple |
International transfers
Supabase, Sentry and Geoapify all hold data within the EEA. Transfers from the UK to the EEA are permitted under the UK's adequacy regulations, so no International Data Transfer Agreement or Standard Contractual Clauses are required for them.
Supabase, Sentry and Vercel are US-incorporated companies hosting in the EU; Data Processing Agreements incorporating Standard Contractual Clauses are in place with each. Stripe's contracting entity for UK and EU customers is its Irish company, which relies on Standard Contractual Clauses for its own intra-group transfers.
Apple (iPhone) and Google (Android) each receive a device token and the notification text in the United States. This is unavoidable for delivering notifications to a phone and is limited to what appears on the lock screen. Apple and Google also receive a sign-in event when a user chooses their sign-in button; both are certified under the EU–US Data Privacy Framework and its UK Extension, which is the transfer mechanism relied on. Neither receives any project content.