Sub-processor Register

• Supabase (authentication & Postgres database hosting) — UK/EEA region — hosting of application data.
• Vercel (application hosting & delivery) — processes request data and logs.
• Resend (transactional email) — processes recipient email addresses and message content for account, rota and family notifications.
• Google (Gemini AI) — processes the specific content submitted to an AI feature at the time of use, to generate the response. Not used to train Google's models under the API terms.

We will update this register and notify customers before adding or replacing a sub-processor that processes personal data, allowing a reasonable period to object. Rotate any credentials referenced in configuration before go-live.