Sub-processors

1. How to read this list

Smoko Software Limited is the data controller for your account and processes your data under our Privacy Policy. The companies below are sub-processors: they handle data on our instructions, under contract, and only for the purpose listed.

Several of them are only involved if you choose to turn something on. Nothing reaches Stripe until you connect Stripe, nothing reaches OpenAI until you use AI triage, and nothing reaches Xero until you authorise it.

2. Neon (Databricks Inc.)

• What they do: Hosts the Postgres database holding your jobs, quotes, invoices and customer details.
• Where: Australia (Sydney) or United States, depending on the region your account was created in.

3. Vercel Inc.

• What they do: Runs the web application and API, and stores job photos in Vercel Blob.
• Where: United States, with edge delivery from Sydney for requests from Australasia.

4. Hatched Digital (Hatched Send)

• What they do: Delivers the quote, invoice and reminder emails your business sends. Sees the recipient address and the contents of that email. Hatched Digital is GoSmoko's tech partner; tradies never see this brand in the product.
• Where: United States.

5. Stripe, Inc.

• What they do: Processes card payments when you enable payment links. Sees the invoice amount, reference and your customer's payment details. GoSmoko never receives or stores card numbers.
• Where: United States, with local acquiring in New Zealand and Australia.

6. OpenAI, L.L.C.

• What they do: Reads text you explicitly submit for AI triage and returns a proposed draft. Only used when you use that feature, and only on the text you send.
• Where: United States. Data submitted through the API is not used to train their models.

7. Xero Limited / MYOB Group

• What they do: Receive the invoices and contacts you choose to sync, when you connect them. You are their customer as well as ours.
• Where: New Zealand and Australia.

8. Apple Inc. / Google LLC

• What they do: Deliver push notifications to the mobile app, if you turn them on. They see a device token and the notification text.
• Where: United States.

9. Data leaving New Zealand

Some of these providers hold data outside New Zealand, which Principle 12 of the Privacy Act 2020 permits where the receiving party is subject to comparable safeguards. Each is engaged under a written agreement including standard contractual clauses covering that transfer.

If holding your data only within New Zealand or Australia is a requirement for you — some government and infrastructure work makes it one — email us before signing up and we will tell you honestly whether we can meet it.

10. Changes to this list

We will update this page before a new sub-processor starts handling customer data, not after. If you want to be told when it changes, email us and we will add you to the notification list.

Questions about anything on this page go to privacy@gosmoko.com.