Legal
ProjectCollab Service Providers and Subprocessors
ProjectCollab uses the providers below to operate the Platform. “Subprocessor” is used as a practical list label; a provider may instead act as an independent controller, regulated payment provider, or user-directed third party for some processing.
1. Direct providers
| Provider and status | Purpose | Data that may be processed | Processing location / vendor list |
|---|---|---|---|
| Stripe, Inc. | Client payment capture; ACH; refunds; disputes/chargebacks; Connect account onboarding and identity; payout readiness; transfers; tax reporting | Names and contact details; payment and bank information supplied directly to Stripe; identity and tax information supplied directly to Stripe; payment amounts; provider identifiers; transaction metadata; dispute and fraud data | Stripe, Inc., United States; Stripe privacy and Connected Account Agreement |
| Supabase, Inc. | Authentication, PostgreSQL database, row-level access control, object storage, Edge Functions, realtime or platform operations if enabled | Account and profile data; portfolio assets; jobs; locations; applications; messages; offers; bookings; contracts/invoices; payments and ledger metadata; attendance; disputes; reviews; audit and notification records | United States (AWS us-west-1); Supabase DPA and subprocessor schedule |
| Plus Five Five, Inc. (Resend) | Transactional email delivery and delivery-status handling | Recipient name/email; template and message content; job/payment/payout/dispute context included in the email; delivery metadata | United States; Resend DPA and subprocessors |
| Vercel Inc. | Web hosting, server/runtime execution, CDN, deployment logs, security and operational telemetry according to enabled plan/features | Requests; IP address; user agent; session and application data passing through hosted routes; diagnostic logs; deployment metadata | United States; Vercel DPA and its linked trust-center subprocessor list |
| Google LLC | Optional sign-in and account authentication | Google account identifier; name; email; avatar and OAuth/session metadata within approved scopes | United States; governed by Google's terms and privacy policy |
2. Provider roles
2.1 Stripe is not simply ProjectCollab's subprocessor. Stripe contracts directly with connected accounts and may act independently for regulated payment, identity, fraud, and tax purposes.
2.2 Google acts as an independent controller for a user's Google account and OAuth activity, while processing limited authentication data for ProjectCollab.
2.3 Supabase, Resend, and Vercel act primarily as processors/service providers for ProjectCollab-hosted data, subject to their contracts and any provider-controlled telemetry.
3. User-directed portfolio services
3.1 The prototype and approved design allow users to embed portfolio video hosted by services such as YouTube or Vimeo. Those services are not currently contracted by ProjectCollab to host or transcode uploaded Platform media.
3.2 YouTube and Vimeo are user-directed third-party services and independent controllers, not ProjectCollab subprocessors. If the production product server-fetches metadata, proxies thumbnails, sets third-party cookies, or contracts for hosting, this classification and the Privacy Policy must be updated.
4. Not currently approved or active
4.1 The schema can represent Supabase Storage, Mux, or Cloudflare Stream as a media-asset provider, but that is extensibility—not evidence that Mux or Cloudflare currently processes ProjectCollab user content. Neither is on the active list until selected and integrated.
4.2 No product analytics, advertising, session replay, error-monitoring, background-check, or insurance provider is in use. Generative-AI features, where offered, use Anthropic, PBC (United States) to process only the text a user submits to that feature. Adding one requires a data-flow review, contract/DPA review, security review, Privacy Policy update, and this list update before production use.
4.3 GitHub and local development tools may contain source code and test fixtures but are not approved as production user-data processors. Real user data must not be copied into them without a separate review.
5. Change process
5.1 Before a provider begins processing production personal information, ProjectCollab must record:
- legal entity and service;
- processing purpose and data categories;
- contractual role and DPA status;
- regions and international-transfer mechanism;
- retention/deletion behavior;
- security and incident-notice commitments;
- nested subprocessor notice method; and
- owner and date of approval.
5.3 Operational owner: Jake Larson, ProjectCollab operator
Last production verification: September 15, 2026