GateBud is operated by GateBud Limited (NZBN 9429053810656), a New Zealand business. Like any modern software product, we rely on a small number of specialist providers to run the service. A “subprocessor” is a provider that stores or processes data on our behalf as part of delivering GateBud.
This page lists every subprocessor we use, what they do for us, what data they handle, and where they run. It exists so our customers, and the visitors who check in at their sites, can see exactly who touches GateBud data. For how we handle personal information generally, see our Privacy Policy.
Current subprocessors
SupabaseSydney, Australia
Database, login accounts, and file storage. This is where check-in records, staff accounts, site configuration, and uploaded documents live.
Data involved: Visitor check-in records (names, companies, answers, timestamps), staff account details, organisation configuration, uploaded documents and logos.
VercelUSA company, global delivery network
Hosts the GateBud application and runs the server code that powers it.
Data involved: Web request data passing through the platform, including IP addresses, and short-lived technical logs.
ResendUSA
Sends GateBud's emails: check-in notifications to site managers, team invites, and password resets.
Data involved: Recipient email addresses, and the content of each email. A check-in notification includes the visitor's name and company.
UpstashSydney, Australia
Rate limiting that protects the public check-in pages from abuse and flooding.
Data involved: IP addresses, held briefly as short-lived request counters. No names or check-in content.
SentryEuropean Union (Germany)
Error monitoring, so that when something in the app breaks we can see and fix it.
Data involved: Technical details of failed requests. Configured not to collect personal details by default; error reports may incidentally include technical request data.
PostHogEuropean Union
Product analytics that show us how GateBud is used, so we can improve it.
Data involved: Usage events (pages viewed, features used) with device and network identifiers, and staff account identifiers. Check-in events never include visitor names, companies, or answers.
CloudflareUSA company, global storage network
Holds the nightly off-site backup of the GateBud database, so a copy exists outside our main infrastructure if that infrastructure is ever lost.
Data involved: A complete encrypted copy of the database, taken once a day. It is encrypted before it leaves our systems, so Cloudflare stores a file it cannot read.
GitHubUSA
Stores the GateBud source code and runs the automated jobs that build, test, and back up the platform. The nightly backup job runs here.
Data involved: Source code and configuration. Customer data passes through the backup job in transit only, encrypted, and is not stored on GitHub.
Microsoft ClarityUSA
Session recordings and heatmaps of the signed-in staff dashboard, so we can see where the interface is confusing and improve it. Never runs on the public visitor check-in pages.
Data involved: Mouse movement, clicks, and page structure from the staff dashboard, with staff account identifiers. Configured to mask all text and images by default, so typed input and on-screen client details are hidden.
Overseas storage and safeguards
Some of these providers run outside New Zealand. Where personal information is held overseas, we take reasonable steps to ensure it is subject to safeguards comparable to the New Zealand Privacy Act 2020 (consistent with Information Privacy Principle 12), and each provider is contractually required to protect the data it handles for us. Data is encrypted in transit, and encrypted at rest where supported by our infrastructure providers.
Changes to this list
When we add, remove, or change a subprocessor, we update this page and its “last updated” date. Customers with a signed agreement that provides for notice of subprocessor changes will be notified as that agreement sets out.
Contact
Questions about this list or how a provider handles your information: privacy@gatebud.com.