Subprocessor Register
Status & authority
This Register lists 13 active sub-processors (canonical rows 1–10, 12, and 14) plus 1 design-only future sub-processor (row 13). Canonical row 11 (Base44) was decommissioned on 14/05/2026 and is shown below for transparency but no longer handles any data — see footnote CC-2026-05-14-005. Row 14 (Stripe AU) was added on 18/05/2026 per CC-2026-05-18-003.
Each entry below records: vendor, the capability provided, the destination jurisdiction, whether the entry constitutes a cross-border disclosure under Australian Privacy Principle 8, the category of data handled, and the last-verified date.
Active sub-processors
| # | Vendor | Capability | Destination jurisdiction | APP 8? | Data category | Last verified |
|---|---|---|---|---|---|---|
| 1 | Supabase | Managed PostgreSQL, Edge Functions, Realtime, row-level security, secondary authentication | Sydney (ap-southeast-2) | No | Identifying Farm Data; Personal Information | 17/05/2026 |
| 2 | Vercel | Serverless and Next.js frontend, application APIs, edge network | United States | Yes | Transient request/response data; no persistent Farm Data storage | 17/05/2026 |
| 3 | Render | Long-running services, workers, Apex Postgres | Singapore | Yes | Identifying Farm Data; service telemetry | 17/05/2026 |
| 4 | Clerk | Authentication, JWT issuance, OAuth (Google, Apple) | United States | Yes | Authentication identifiers; session metadata | 17/05/2026 |
| 5 | Anthropic | Foundation models (Claude Opus, Sonnet, Haiku) — inference only; no Farm Data training | United States (direct API) | Yes | Retrieved contextual chunks only — see Data Licence §6 Layer 1 (available on request — hello@digitaldairy.ai) | 17/05/2026 |
| 6 | Pinecone | Vector database for retrieval-augmented generation | Sydney (ap-southeast-2) | No | Vector embeddings of Farm Data; index metadata | 17/05/2026 |
| 7 | GitHub | Source control and continuous integration | United States | Yes — no Farmer PII | Source code; CI artefacts (no Farmer data) | 17/05/2026 |
| 8 | Better Stack | Observability, logs, monitoring | European Union | Yes | Application logs (PII scrubbed at source); infrastructure metrics | 17/05/2026 |
| 9 | Figma | Design and prototyping | United States | Yes — no Farmer data in design files | Design files; mock-up data only (no Farmer data) | 17/05/2026 |
| 10 | Canva | Marketing and brand-system production | Australia | No — no Farmer data | Marketing collateral; brand assets (no Farmer data) | 17/05/2026 |
| 12 | Google Workspace | Working storage; investor and marketing materials | Australia — Sydney and Melbourne under Assured Workloads — Australia Regions | No (primary) | Internal documents; investor / marketing materials; corporate operating data | 17/05/2026 |
| 14 | Stripe Payments Australia Pty Ltd (“Stripe AU”) | Payment processing for Subscription Fees; tokenisation of payment-instrument data per T&Cs §7.5 | Australia (AU entity) — cross-border data-flow path to Stripe's global infrastructure to be confirmed | Pending — confirm | Payment-instrument data (tokenised); transaction metadata; billing address. Payment-instrument detail is not stored by digitaldairy.ai Pty Ltd. | 18/05/2026 |
Row 11 is intentionally absent — see Decommissioned. Row 13 (design-only future sub-processor) is described in the next section.
Planned future sub-processor (design-only)
| # | Vendor | Capability | Target jurisdiction | APP 8? | Scope | Status |
|---|---|---|---|---|---|---|
| 13 | Voyage AI (MongoDB) | Embedding models for knowledge-base content used in retrieval-augmented generation | MongoDB Atlas Sydney (target) | n/a until provisioned | digitaldairy.ai's own knowledge-base content only — not Farmer Personal Information or Farm Data | Design-only |
Voyage AI is documented here for transparency. It is not yet provisioned as a sub-processor at the date of this Register. Any future scope extension beyond knowledge-base content (for example, any move to embed Farm Data) will trigger:
- a material-change notice under Privacy Policy §13;
- the renewed-consent path (available on request — hello@digitaldairy.ai) under Data Licence §11; and
- an update to this Register before any production scope change takes effect.
Decommissioned
| # | Vendor | Status | Decommission date | Reference |
|---|---|---|---|---|
| 11 | Base44 | Decommissioned | 14/05/2026 | CC-2026-05-14-005 |
Data category legend
- Identifying Farm Data — Farm Data that identifies a particular Farmer, farm, or both (see Data Licence §3.4 (available on request — hello@digitaldairy.ai)).
- Non-identifying Farm Data — Farm Data stripped of identifiers to a remote-risk re-identification standard (see Data Licence §3.5 (available on request — hello@digitaldairy.ai)).
- Personal Information — as defined in section 6 of the Privacy Act 1988 (Cth).
- Authentication identifiers / session metadata — Clerk-issued identifiers; login timestamps.
- Vector embeddings — numerical representations of Farm Data used for retrieval, not raw Farm Data.
- Retrieved contextual chunks — minimal contextual fragments sent to Anthropic at inference time; not raw Farm Data corpus (see Data Licence §6 Layer 1 (available on request — hello@digitaldairy.ai)).
Change log
| Date | Change | Reference |
|---|---|---|
| 18/05/2026 | Stripe AU added as row 14. Payment Sub-processor for Subscription Fees per T&Cs §7.5. AU entity (Stripe Payments Australia Pty Ltd). Tokenisation of payment-instrument data; no payment-instrument storage by digitaldairy.ai Pty Ltd. ABN and APP 8 cross-border narrative pending confirmation by clara/Alex before counsel red-line. | CC-2026-05-18-003 |
| 17/05/2026 | Register published — initial v1 alongside the legal corpus. Captures 12 active rows (1–10, 12) and 1 design-only row (13). | Corpus v1 ratification |
| 14/05/2026 | Base44 decommissioned — row 11 vacated; row retained for canonical numbering. | CC-2026-05-14-005 |
| 14/05/2026 | Embedding sub-processor identity re-anchored to Voyage AI (MongoDB). Status remains design-only. | CC-2026-05-14-006 |
| 14/05/2026 | Google Workspace recorded as Sydney + Melbourne under Assured Workloads — Australia Regions. | CC-2026-05-14-007 |
Material-change notice. Addition of Stripe AU as a payment Sub-processor under Privacy Policy §13 and the renewed-consent path (available on request — hello@digitaldairy.ai) under Data Licence §11 will be served on existing Farmers prior to the Subscription Term in which Stripe AU first processes that Farmer's Subscription Fees.
Contact
Questions about this Register, or requests for the specific contractual no-training clause references under Data Licence §6 Layer 2 (available on request — hello@digitaldairy.ai), are answered by the acting Privacy Officer at privacy@digitaldairy.ai.
Farmers may also exercise the right of inspection (available on request — hello@digitaldairy.ai) under Data Licence §13 to obtain a written summary of the sub-processors handling their Identifying Farm Data.