Legal
Subprocessors
Last updated June 4, 2026
Bossy uses a small set of trusted third-party providers ("subprocessors") to deliver the service. Each is bound by contract to protect personal data and to use it only to provide their service to us. This list may change as our infrastructure evolves; material additions are reflected here.
Current subprocessors
| Provider | Purpose | Data processed |
|---|---|---|
| Supabase | Database, authentication, and file storage | Account data, app content (including task photos), authentication data |
| Vercel | Application hosting and content delivery | Request/log data, usage data |
| Stripe | Payment processing and subscription billing | Billing contact and payment data (card data is held by Stripe; Bossy does not store full card numbers) |
| Resend | Transactional and marketing email delivery | Recipient email, email content |
| Twilio | SMS and WhatsApp notification delivery | Mobile number, message content (where the SMS/WhatsApp feature is enabled) |
| Sentry | Error monitoring and diagnostics | Diagnostic and limited event data |
| PostHog | Product analytics | Usage events, device/approximate-location data |
Hosting region
Data is processed primarily in the United States.
Notification of changes
To be notified of new subprocessors, contact privacy@bossyhq.com. Customers may raise reasonable objections to a new subprocessor as described in our Data Processing Addendum.