Last updated: September 18, 2026
This list reflects the third parties that process data on GnomeOwner's behalf. We update it as our providers change; material changes (a new category of processing, a new type of data collected, or processing in a new country) are notified to account holders by email or in-app notice before the change takes effect, per our Privacy Policy.
| Sub-processor | Purpose | Data processed | Location | Signed data-processing terms | Privacy policy |
|---|---|---|---|---|---|
| Supabase | Database, authentication, file storage | All app data (isolated per HOA via row-level security) | US (AWS us-east-1) | Pending confirmation | supabase.com/privacy |
| Vercel | Application hosting & CDN | Request / usage metadata | US | Pending confirmation | vercel.com/legal/privacy-policy |
| Google (Gemini) | AI: document search, board assistant, meeting transcription | Document text, financial figures, meeting audio, user queries — per-request; not used for training | US | Pending confirmation | ai.google.dev |
| Groq | AI: text features | Text submitted per-request; not used for training | US | Pending confirmation | groq.com |
| Mistral AI | AI: scanned-document text extraction (OCR), via direct API | Scanned document page images, per-request; not used for training; zero data retention (organization-level ZDR active on our account) | Pending verification | Pending confirmation | legal.mistral.ai |
| OpenRouter | AI: board assistant text generation — OpenRouter routes the assistant's requests to zero-data-retention inference hosts serving the DeepSeek V4 Flash model (an open-weights model). Our account's Zero-Data-Retention policy excludes DeepSeek's own first-party endpoints, so requests are served by ZDR-eligible hosts (e.g. Together, Fireworks, DeepInfra), not by DeepSeek's servers. Also candidate-model evaluation. | Board assistant queries, association financial figures and owner details, and governing-document excerpts, per-request; routed only to zero-data-retention endpoints under OpenRouter's account-level data policy (requests that would require retention are rejected); not used for training; request metadata retained for billing. | US (OpenRouter); inference-host location pending verification | Pending confirmation | openrouter.ai/privacy |
| Plaid | Read-only bank transaction data for dues reconciliation | Bank transaction data (read-only) | US | Pending confirmation | plaid.com/legal |
| Stripe | Subscription billing + dues routing (Connect) | Billing/payment data (card data stays with Stripe) | US | Pending confirmation | stripe.com/privacy |
| Resend | Transactional & notice email delivery | Recipient email + message content | US | Pending confirmation | resend.com/legal |
| Lob | Printed & mailed letters (owner notices sent by postal mail, when a board chooses paper delivery) | Recipient name + mailing address, letter content | US | Pending signature | lob.com/privacy |
| Sentry (Functional Software, Inc.) | Error monitoring — receives error reports (scrubbed of personal data) to keep the service reliable | Error/crash reports: stack traces, request context, and diagnostic breadcrumbs; cookies, headers, session/user identifiers, and database-query values embedded in request URLs are stripped before sending; not used for training | US | Pending confirmation | sentry.io/privacy |
"Signed data-processing terms" reflects whether GnomeOwner has an executed data-processing agreement (DPA) or equivalent contractual terms on file with that vendor. Values of "Pending confirmation" mean this has not yet been verified against the vendor's executed agreement and should not be read as either confirmation or denial of a signed DPA. "Pending signature" means the vendor's DPA has been received and is awaiting execution.
This list is maintained internally and reviewed for accuracy. We update it directly when a provider in an existing category changes or is added; a change to a new category of processing, a new type of data collected, or processing in a new country is treated as material and triggers the notice described above.