Sub-Processors

Last Updated: March 3, 2026

1.Introduction

TrackLoop uses carefully selected third-party service providers (“sub-processors”) to help deliver our services. Each sub-processor is bound by data processing agreements and meets our security standards. This page provides transparency into who processes your data and how it is protected.

2.Infrastructure

Vercel

DPA Active

Hosting & edge delivery

Data Processed:: Application data, server logs, IP addresses
Location:: USA (global CDN)
Certifications:: SOC 2 Type II

Supabase

DPA Active

Database & authentication

Data Processed:: All tenant data, authentication tokens, user profiles
Location:: Canada (ca-central-1)
Certifications:: SOC 2 Type II

3.Payments

Stripe

DPA Active

Billing & payment processing

Data Processed:: Billing contact information, payment metadata
Location:: USA
Certifications:: PCI DSS Level 1, SOC 2 Type II

4.Communications

Resend

DPA Active

Transactional email delivery

Data Processed:: Email addresses, email content
Location:: USA
Certifications:: —

5.Monitoring

Sentry

DPA Active

Error monitoring & performance

Data Processed:: Error traces, anonymized application context
Location:: USA
Certifications:: SOC 2 Type II

Inngest

DPA Active

Background job processing

Data Processed:: Job payloads (order and customer data)
Location:: USA
Certifications:: —

6.Changes to Sub-Processors

We are committed to transparency regarding any changes to our sub-processor list. The following process applies when we add or replace a sub-processor:

1.30-Day Advance Notice: We will provide at least 30 days' advance written notice before adding any new sub-processor to this list.
2.Email Notification: All affected tenants will receive email notification detailing the new sub-processor, the data it will process, and the reason for the change.
3.Right to Object: Tenants may object to the addition of a new sub-processor within 30 days of receiving notification. If we are unable to resolve the concerns, the tenant may terminate their agreement in accordance with the terms of service.

7.Contact

For questions about our sub-processors or data processing practices, please contact our Privacy Officer:

Privacy Officer:: VIRTUALLIFE TECHNOLOGIES INC.
Email:: privacy@trackloop.ca

Related Policies:

2.Infrastructure

Vercel

DPA Active

Hosting & edge delivery

Data Processed:: Application data, server logs, IP addresses
Location:: USA (global CDN)
Certifications:: SOC 2 Type II

Supabase

DPA Active

Database & authentication

Data Processed:: All tenant data, authentication tokens, user profiles
Location:: Canada (ca-central-1)
Certifications:: SOC 2 Type II

5.Monitoring

Sentry

DPA Active

Error monitoring & performance

Data Processed:: Error traces, anonymized application context
Location:: USA
Certifications:: SOC 2 Type II

Inngest

DPA Active

Background job processing

Data Processed:: Job payloads (order and customer data)
Location:: USA
Certifications:: —

6.Changes to Sub-Processors

We are committed to transparency regarding any changes to our sub-processor list. The following process applies when we add or replace a sub-processor:

1.30-Day Advance Notice: We will provide at least 30 days' advance written notice before adding any new sub-processor to this list.
2.Email Notification: All affected tenants will receive email notification detailing the new sub-processor, the data it will process, and the reason for the change.
3.Right to Object: Tenants may object to the addition of a new sub-processor within 30 days of receiving notification. If we are unable to resolve the concerns, the tenant may terminate their agreement in accordance with the terms of service.