GateBud™ is operated by GateBud Limited (NZBN 9429053810656), a New Zealand business. Like any modern software product, we rely on a small number of specialist providers to run the service. A “subprocessor” is a provider that stores or processes data on our behalf as part of delivering GateBud.
This page lists every subprocessor we use, what they do for us, what data they handle, and where they run. It exists so our customers, and the visitors who check in at their sites, can see exactly who touches GateBud data. For how we handle personal information generally, see our Privacy Policy.
Current subprocessors
SupabaseSydney, Australia
Database, login accounts, and file storage. This is where check-in records, staff accounts, site configuration, and uploaded documents live.
Data involved: Visitor check-in records (names, companies, answers, timestamps), staff account details, organisation configuration, uploaded documents and logos.
VercelUSA company, app runs in Sydney, Australia (global delivery network)
Hosts the GateBud application and runs the server code that powers it.
Data involved: Web request data passing through the platform, including IP addresses, and short-lived technical logs.
ResendUSA
Sends GateBud's emails: check-in notifications to site managers, team invites, and password resets.
Data involved: Recipient email addresses, and the content of each email. A check-in notification includes the visitor's name and company.
UpstashSydney, Australia
Rate limiting that protects the public check-in pages from abuse and flooding.
Data involved: IP addresses, held briefly as short-lived request counters. No names or check-in content.
SentryEuropean Union (Germany)
Error monitoring, so that when something in the app breaks we can see and fix it.
Data involved: Technical details of failed requests. Configured not to collect personal details by default; error reports may incidentally include technical request data.
PostHogEuropean Union
Product analytics that show us how GateBud is used, so we can improve it.
Data involved: Usage events (pages viewed, features used) with device and network identifiers, and staff account identifiers. Check-in events never include visitor names, companies, or answers.
CloudflareUSA company, global storage network
Holds the nightly off-site backup of the GateBud database and of uploaded files such as documents, site maps and logos, so a copy exists outside our main infrastructure if that infrastructure is ever lost.
Data involved: A complete encrypted copy of the database and of uploaded files, taken once a day and kept for 30 days. It is encrypted before it leaves our systems, so Cloudflare stores files it cannot read.
GitHubUSA
Stores the GateBud source code and runs the automated jobs that build, test, and back up the platform. The nightly backup job runs here.
Data involved: Source code and configuration. Backup jobs temporarily process customer data on GitHub-hosted runners, including unencrypted data during backup creation and restore checks. Off-site backup files are encrypted before upload to Cloudflare R2. Customer data is not committed to the repository or retained as a workflow artifact.
Microsoft ClarityUSA
Session recordings and heatmaps of the signed-in staff dashboard, so we can see where the interface is confusing and improve it. Never runs on the public visitor check-in pages.
Data involved: Mouse movement, clicks, and page structure from the staff dashboard, with staff account identifiers. Configured to mask all text and images by default, so typed input and on-screen client details are hidden.
Google WorkspaceUSA company, global infrastructure
Hosts GateBud's own email inboxes (for example privacy@, support@ and security@). Personal information can reach these inboxes when someone emails us, for example a visitor asking us to remove their details.
Data involved: The content of emails to and from GateBud's mailboxes, which can include a person's name and whatever they choose to tell us. Not used to store check-in records.
Overseas storage and safeguards
Some of these providers run outside New Zealand. Where personal information is held overseas, we take reasonable steps to ensure it is subject to safeguards comparable to the New Zealand Privacy Act 2020 (consistent with Information Privacy Principle 12), and each provider is contractually required to protect the data it handles for us. Data is encrypted in transit, and encrypted at rest where supported by our infrastructure providers.
Changes to this list
When we add, remove, or change a subprocessor, we update this page and its “last updated” date. Customers with a signed agreement that provides for notice of subprocessor changes will be notified as that agreement sets out.
Contact
Questions about this list or how a provider handles your information: privacy@gatebud.com.