ExactPour Subprocessors
Version 2.3 · effective October 7, 2026
ExactPour Subprocessors
Last updated: October 7, 2026
To provide the ExactPour Service, we engage the third-party subprocessors listed below. Each subprocessor is bound by contractual obligations (including appropriate data-protection and confidentiality terms) that are consistent with our Data Processing Agreement (DPA) and applicable Data Protection Law.
We provide at least thirty (30) days' prior notice of any new or replacement subprocessor by updating this page and by email to the account address on file, consistent with the Data Processing Agreement. Email support@exactpour.com to confirm that address or to add another recipient. Customers with a signed DPA that includes objection rights may object to a new subprocessor on reasonable data-protection grounds as described in the DPA.
Infrastructure and Core Platform
| Subprocessor | Legal Entity | Purpose | Data Categories Processed | Region | Transfer Mechanism | Privacy Policy |
|---|---|---|---|---|---|---|
| Supabase | Supabase, Inc. | Database, authentication, file storage, edge functions | Account data, auth credentials (hashed), inventory and operational data, uploaded files | US | SCCs | supabase.com/privacy |
| Netlify | Netlify, Inc. | Hosting for exactpour.com | Visitor IP address, request logs, and pages requested | US | SCCs | netlify.com/privacy |
| Stripe | Stripe, Inc. | Payment processing and subscription billing | Billing contact information, payment tokens (ExactPour does not store full card numbers) | US / Global | SCCs / DPF | stripe.com/privacy |
Integrations (Enabled at Customer's Direction)
| Subprocessor | Legal Entity | Purpose | Data Categories Processed | Region | Transfer Mechanism | Privacy Policy |
|---|---|---|---|---|---|---|
| Toast, Inc. | Toast, Inc. | POS integration (menus, sales, inventory sync) | Menu items, sales data, location data | US | N/A (US) | pos.toasttab.com/privacy |
| Square | Block, Inc. | POS integration when the customer connects Square | Menu items, sales data, location data | US | N/A (US) | squareup.com/us/en/legal/general/privacy |
| Clover | Clover Network, LLC | POS integration when the customer connects Clover | Menu items, sales data, location data | US | N/A (US) | clover.com/privacy-policy |
| GoTab | GoTab, Inc. | POS integration when the customer connects GoTab | Menu items, sales data, location data | US | N/A (US) | gotab.com/privacy-policy |
| Go-UPC | Go-UPC | Barcode and UPC product lookup | Scanned barcodes and product lookup queries | US | N/A (US) | go-upc.com/privacy-policy |
Analytics and AI (Optional / Feature-Dependent)
| Subprocessor | Legal Entity | Purpose | Data Categories Processed | Region | Transfer Mechanism | Privacy Policy |
|---|---|---|---|---|---|---|
| Google Analytics | Google LLC | Website and in-app usage analytics (only when enabled and, on the marketing site, consented) | Device and usage data, IP address (anonymized where applicable) | US / Global | SCCs / DPF | policies.google.com/privacy |
| Meta | Meta Platforms, Inc. | Marketing-site campaign measurement, only when a pixel ID is configured and ads consent is granted | Page events, browser identifiers, and limited conversion data | US | SCCs | facebook.com/privacy/policy |
| Sentry | Functional Software, Inc. | Mobile crash reporting | Crash diagnostics and device data | US | SCCs | sentry.io/privacy |
| PostHog | PostHog, Inc. | Mobile product analytics | Product usage events | US / EU | SCCs | posthog.com/privacy |
| Calendly | Calendly, LLC | Demo scheduling | Name, email, and the time you book | US | SCCs | calendly.com/legal/privacy-notice |
| Anthropic | Anthropic, PBC | AI features (e.g., invoice extraction, insights, recommendations) | Content submitted to AI features (e.g., invoices, prompts) | US | SCCs | anthropic.com/legal/privacy |
| Mistral AI | Mistral AI | Invoice OCR layout prepass (optional; used with Anthropic for structured extraction) | Uploaded invoice PDFs/images and OCR text derived from them | EU / US | SCCs | mistral.ai/terms |
Notes on AI Subprocessors. Anthropic, Mistral, and any other AI providers we use are contractually required to process data only to deliver the requested feature and are prohibited from using Customer Data to train or improve their foundation models unless the customer authorizes that feature in writing.
How to Receive Notifications
Notice goes to the email address on the account. To confirm that address, or to add another recipient, contact support@exactpour.com.
Contact
support@exactpour.com · ExactPour LLC · exactpour.com