Sub-Processors
Last updated: 2026-05-17
HCC StockWatcher engages the following third-party service providers ("sub-processors") to operate the service. Each sub-processor is bound by a written data processing agreement and is selected only after a security review.
| Sub-Processor | Purpose | Region | DPA / Reference |
|---|---|---|---|
| Supabase Inc. | Managed PostgreSQL database, authentication, and storage backplane. | Cloud (region pinned per project — currently AWS) | supabase.com/legal/dpa… |
| Render Services Inc. | Static-site and Express-backend hosting; HTTPS termination; CI/CD. | AWS | render.com/legal/dpa… |
| Stripe, Inc. | Subscription billing, payment processing, customer billing portal. Cardholder data never touches HCC StockWatcher servers — Stripe.js / Elements is used in iframe mode (PCI DSS SAQ-A scope). | US/EU (per Stripe's residency program) | stripe.com/legal/dpa… |
| Google LLC (Gemini API) | AI features (chat, smart notes, NL screener). By default we send only aggregate portfolio data (sector / market / size buckets); detailed context (per-position dollars, symbols, transactions) is sent only when the user explicitly opts in per message. | Multi-region | cloud.google.com/terms/data-processing-a… |
| Yahoo Finance / Financial Modeling Prep / CoinGecko | Public market data (quotes, fundamentals, historical prices). No user PII is sent — only ticker symbols. | Global | Public API / no PII transmitted |
| Frankfurter (Frankfurter.app) | Foreign-exchange rate lookups. No user PII is transmitted — only currency-pair queries. | EU | www.frankfurter.app/… |
| SMTP relay (Resend or configured provider) | Transactional email delivery (password reset, account confirmation, weekly digest, novel-geo security alerts). | Per provider | Public API / no PII transmitted |
| (Optional) Sentry / observability vendor | Application error monitoring. Configured to scrub PII payloads (`beforeSend` hook strips emails, tokens, financial values). Only enabled when SENTRY_DSN is set. | US/EU | sentry.io/legal/dpa/… |
Sub-Processor Notice
We will provide reasonable notice via the privacy policy or in-app notification before engaging a new sub-processor. If you object to a new sub-processor, you may terminate your subscription with a prorated refund.
Contact
For questions about sub-processors or to request a copy of a specific DPA, email privacy@stockwatcher.ca.