Sub-processors

1. How to read this list

GOSMOKO LIMITED handles your customers' details on your behalf under our Data processing terms, and your own account details under our Privacy policy. The companies below are sub-processors: they handle data on our instructions, under contract, and only for the purpose listed.

Several are only involved if you turn something on. Nothing reaches OpenAI until you use an AI feature, nothing reaches Twilio or TNZ until your business uses the SMS add-on, and nothing reaches Xero or your own Stripe account until you connect them.

2. Neon (Databricks Inc.)

• What they do: Hosts the Postgres database holding your jobs, quotes, invoices and customer details, and keeps its point-in-time history and daily snapshots.
• Where: Australia (Sydney, AWS ap-southeast-2).

3. Vercel Inc.

• What they do: Runs the web application and API, and stores job photos and files in Vercel Blob.
• Where: Application in Australia (Sydney). Photo and file storage, and edge delivery, may be in the United States.

4. GitHub, Inc.

• What they do: Holds our nightly database backups. Each backup is encrypted before it leaves our systems, so GitHub cannot read it. Kept for 35 days.
• Where: United States.

5. Hatched Digital (Hatched Send)

• What they do: Delivers the quote, invoice and reminder emails your business sends, and our account emails to you. Sees the recipient address and the contents of that email. Hatched Digital is GoSmoko's technology partner.
• Where: United States.

6. Cloudflare, Inc.

• What they do: Receives supplier bills emailed to your business's bills address and passes them to GoSmoko. Only involved if you or your suppliers use that address.
• Where: Global network; processed at the location nearest the sender.

7. Twilio Inc.

• What they do: Delivers texts to your customers' Australian mobiles when your business uses the SMS add-on. Sees the phone number and the text.
• Where: United States.

8. TNZ Group Limited

• What they do: Delivers texts to your customers' New Zealand mobiles when your business uses the SMS add-on. Sees the phone number and the text. Not yet in use: we will update this page when New Zealand texting goes live.
• Where: New Zealand.

9. OpenAI, L.L.C.

• What they do: Turns short voice recordings into text, and reads text, files and job chats you ask an AI feature to read, along with the business context it needs to match things up. Only used when you use an AI feature. Does not train on API data; may keep it up to 30 days for abuse monitoring.
• Where: United States.

10. Google LLC

• What they do: Looks up and checks addresses as you type them (Google Maps Platform), and confirms who you are if you choose Sign in with Google. Sees the address or location being looked up, or your Google sign-in.
• Where: United States.

11. Stripe, Inc.

• What they do: Bills your GoSmoko subscription. If you connect your own Stripe account, also processes your customers' card payments under your Stripe agreement. GoSmoko never receives or stores card numbers.
• Where: United States, with local acquiring in New Zealand and Australia.

12. Xero Limited

• What they do: Receives the invoices and contacts you choose to sync, and sends back contacts you choose to import, when you connect Xero. You are their customer as well as ours.
• Where: New Zealand and Australia, with processing in the United States.

13. Apple Inc. / Google LLC

• What they do: Deliver push notifications to the phone app, if you turn them on. They see a device token and the notification text.
• Where: United States.

14. Data leaving New Zealand and Australia

Some of these providers hold data outside New Zealand and Australia. We only use them where principle 12 of the Privacy Act 2020 allows (the recipient is subject to comparable safeguards, or bound by contract to protect the information to that standard), and we take reasonable steps under Australian Privacy Principle 8. Each is engaged under its written data protection terms.

If holding your data only within New Zealand or Australia is a requirement for you (some government and infrastructure work makes it one), email us before signing up and we will tell you honestly whether we can meet it.

15. Changes to this list

We will update this page before a new sub-processor starts handling customer data, not after. If you want to be told when it changes, email us and we will add you to the notification list.

Questions about anything on this page go to privacy@gosmoko.com.