Subprocessors
Effective August 13, 2026
These are the companies that help us run QuoCAD, and what each one receives. Most of them handle information only on our instructions and only to provide their service to us. Four of them — Stripe, Square, Mapbox and Azure Maps — also handle some data for their own purposes, as independent controllers rather than as our subprocessors; section 7a of our Data Processing Addendum explains what that means and what we can answer for. None of them is permitted to sell your information or use it for advertising.
Some of this information is about your customers rather than about you. You remain responsible for that information; we handle it on your behalf. See section 7a of the Privacy Policy.
Subprocessors
Providers that process customer personal data on QuoCAD's documented instructions. This is the list the Data Processing Addendum refers to for Annex III of the Standard Contractual Clauses.
Supabase
United StatesAuthentication, database, and file storage
Everything you store in QuoCAD: your account, your workspace, your contacts and their details, jobs, quotes, invoices, and uploaded images.
Vercel
United States (global edge network)Hosting and content delivery
All requests to QuoCAD pass through it, including IP addresses and request logs.
Resend
United StatesTransactional email
Recipient name and email address, and the content of the message — including quotes and invoices you send to your customers, team invitations, and password resets.
Sentry
United StatesError monitoring
Diagnostic details when something fails: the error, the page, your user and workspace identifiers, and a support reference. We configure it not to send personal details, and email addresses are stripped before an event is stored.
Upstash
United StatesRate limiting
Your user identifier and IP address, held briefly to count requests and block abuse.
PostHog
United StatesProduct analytics
Which features are used and how the app performs, tied to your user and workspace identifiers. Not the contents of your jobs, quotes, or customer records.
Optional — In your browser, only after you accept analytics. A small number of server-side events — account creation, sign-in, checkout — are recorded regardless, as described in the Cookie Policy.
Other third parties (independent controllers)
Providers that decide for themselves what they do with some of the data they receive, under their own terms and privacy policies. They are not our subprocessors and are not part of the Annex III list, but they are disclosed here because data reaches them when you use the features they power.
Stripe
United StatesSubscription billing, and card payments from your customers
Your billing name, email and address; card details, which are entered on Stripe's own pages and never reach us; and, if you accept card payments, your customer's payment details. Stripe and Square are our service providers only for the billing data we send them for your own subscription.
Square
United StatesCard payments from your customers (alternative to Stripe)
Your customer's payment events for invoices you issue. Stripe and Square are our service providers only for the billing data we send them for your own subscription.
Optional — Only if you connect a Square account.
Mapbox
United StatesMap imagery, address search, and travel distance
Job site addresses and coordinates when you search for a property or request a travel estimate.
Azure Maps (Microsoft)
United States / Microsoft globalSatellite and aerial imagery
The map area being viewed. Imagery is streamed live and is not stored by us.
Optional — Only where enabled for your workspace.
Changes. We update this page when a provider is added or removed. If you need advance notice of changes for your own compliance, contact us and we will add you to the notification list.
International transfers. QuoCAD is operated from Canada and these providers process data in the United States and other countries. We rely on their standard contractual clauses and equivalent safeguards.
Not used. We do not use advertising networks, data brokers, or marketing trackers such as Google Analytics or Facebook Pixel. Documents are generated by us rather than sent to a third-party service.