Sub-processors
Last updated: September 24, 2026 · Effective: September 24, 2026
This page lists the third-party service providers ("sub-processors") that Scorecrypt, LLC ("Scorecrypt," "we," "us," or "our") engages to process personal information on our behalf in connection with the Scorecrypt websites, our web application, and our mobile and tablet applications (together, the "Services"). It supplements, and should be read together with, our Privacy Policy and Cookie Policy. The Services are intended for use in the United States only.
Each sub-processor is permitted to process personal information only on our instructions and for the purposes we specify, consistent with our Privacy Policy and applicable law.
1. What a sub-processor is
A sub-processor is a third-party company we engage to process personal information on our behalf so we can provide the Services — for example, to host our application, store data, deliver email, or process payments. We remain responsible to you for how these providers handle personal information under our Privacy Policy.
2. Our current sub-processors
We engage the following sub-processors to provide the Services.
| Sub-processor | What we use it for | Category | Primary processing region |
|---|---|---|---|
| Supabase | Database and cloud hosting for the Services | Infrastructure | United States |
| Vercel | Application and website hosting and content delivery | Infrastructure | United States (functions); edge network global |
| Stripe | Payment processing for paid plans | Payments | United States; global transfer reserved under its DPA |
| Resend | Transactional email delivery (for example, sign-in and notifications) | Email delivery | United States (sending); tracking domain on a global CDN |
| Statsig | Feature flags and product experimentation | Experimentation | United States |
| Sentry | Error monitoring and performance diagnostics — receives error and diagnostic reports from the Services, which may include limited identifiers that appear in error context | Error monitoring | United States |
| OpenAI | Automated safety screening of message text in the messaging feature, after delivery and for harm signals only. It receives the message text alone, with no names or other identifiers; OpenAI retains none of it for this service and does not use it for training | Safety screening | United States (default API region); transfer reserved under its DPA |
Our Cookie Policy describes the cookies our site sets, which of these providers receives their values, and how to block them.
3. How we manage sub-processors
Each sub-processor listed above may process personal information only on our instructions and for the purposes we specify, consistent with our Privacy Policy. We do not sell personal information, and we do not share it for cross-context behavioral or targeted advertising.
4. Children
Consistent with our Children's Privacy Notice, we do not permit our providers to use minors' information for advertising, and we work to minimize the information about minors that flows to analytics and experimentation providers.
5. Changes to this list
The specific providers we use may change. We will update this page when we add or replace a sub-processor, and the "Last updated" date above shows when it was last revised.
6. Contact
Questions about our sub-processors? Contact us at privacy@scorecrypt.com.