a subprocessor is a third party we engage to process customer or participant data on our behalf so that the architecture can run. we use a small set of reputable, established providers. this list may be updated as our infrastructure evolves, and we provide written notice before adding a new subprocessor.
| name | purpose | data processed | region |
|---|---|---|---|
| Vercel | application hosting and serverless compute | request data passing through the application and serverless functions | US |
| Cloudflare | hosting for drylies.com, plus CDN and DNS | request data, DNS queries, and edge-cached assets | US and global edge |
| Supabase | primary database (Postgres) | readings, email addresses, and the behavioral timing signal | US |
| Stripe | payments and subscriptions | payment and billing data. Noctara never stores card numbers. PCI-DSS Level 1. | US and global |
| Anthropic (Claude API) | AI processing of reading inputs to produce the reading | reading text, processed transiently. No training on API data per Anthropic's terms. | US |
| Resend | transactional and outreach email delivery | email addresses and message content | US |
| Apple | Sign in with Apple and App Store in-app purchases (iOS) | authentication tokens and in-app purchase receipts | US and global |
| Clerk | enterprise SSO and authentication for some surfaces | authentication identifiers | US |
| Meta | website analytics pixel and conversions API | hashed event data | US and global |
for questions about this list or any subprocessor, write to hello@noctaracorp.com.