Subprocessors
Every company that touches your data.
Each line comes from the code that calls the company, so the list cannot fall behind. Effective October 8, 2026.
Last updated
List of 2026-10-07
Subprocessors and other recipients
Subprocessors get customer personal data to run CleanCleaver. Other recipients are services your own browser or phone talks to, or that get no customer personal data. A new subprocessor is announced here and by email to business customers 30 days before it starts.
| Company | What it does | What it gets | Where | Kind |
|---|---|---|---|---|
| Fly.io Fly.io, Inc. | Hosts the app, the API, the Postgres database, the photo volume, snapshots and logs. | Everything we store to run the service. | United States. | Subprocessor |
| Tigris (object storage, through Fly.io) Tigris Data | Not in use today: photos and uploaded files are kept on our Fly.io servers. If we turn it on, it keeps them in private storage. | Every photo and uploaded file (paper-log and setup scans, place, equipment and permit photos, report PDFs), as private objects. | Not in use today. | Subprocessor |
| Postmark AC PM LLC (an ActiveCampaign company) | Sends sign-in codes, trial and billing notices, deletion notices, review and checklist emails. | Email address, the message text. | United States. | Subprocessor |
| Stripe Stripe, Inc. | Card payments, subscriptions, the billing portal. | Billing name, email, business name, card (typed on Stripe's pages only), plan and invoices. | United States. | Subprocessor |
| Anthropic (Claude API) Anthropic, PBC | Ask answers and backup picks, the auto-answer drafts, reading paper-log and set-up photos (with Gemini's reading), the AI RoomCheck second look, and the team site's one-line summaries of support conversations (the feedback loop). | Ask questions with emails, phone numbers and known names removed; photos of paper logs, kitchens and receipts; room photos (AI RoomCheck, off by default); support conversations (app, email, chat) as customer/us lines with emails, phone numbers, card numbers and known names blanked, never a thread in which any message trips the health keyword heuristic. Never a health check-in answer. | United States. | Subprocessor |
| Google (Gemini API) Google LLC | Reads paper-log, set-up and food photos; translates voice words in languages other than English and Spanish; AI RoomCheck first pass. | The photo or the words sent. | United States (Google's global infrastructure). | Subprocessor |
| Google (Firebase Authentication) Google LLC | "Continue with Google" sign-in only. | Email, name and Google account id in the sign-in token. | United States. | Subprocessor |
| Google (Business Profile APIs, "Connect your Google Maps profile") Google LLC | Only when an owner or admin connects their Google Maps profile: reads that profile's hours once and sends the business's opening hours and holiday hours to it. | The business's opening and holiday hours, sent to the owner's own Google profile; Google's OAuth tokens for the owner's Google account (kept sealed by us). No staff, health or customer data. | United States (Google's global infrastructure). | Other recipient |
| Expo (push relay for the phone app) 650 Industries, Inc. (Expo) | Delivers phone reminders to Apple (APNs) and Google (FCM). | The phone's push token and the reminder text (no health detail). | United States. | Subprocessor |
| Apple (APNs, iPhone reminders) Apple Inc. | Delivers phone reminders to iPhones straight from our server (no Expo relay). | The iPhone's push token and the reminder text (no health detail). | United States. | Subprocessor |
| Google (Firebase Cloud Messaging, Android reminders) Google LLC | Delivers phone reminders to Android phones straight from our server (no Expo relay). | The Android phone's push token and the reminder text (no health detail). | United States (Google's global infrastructure). | Subprocessor |
| Browser push services (Apple, Google, Mozilla, Microsoft) The browser maker's push service | Delivers browser reminders to the browser that asked for them. | The browser's push endpoint and a payload sealed for that browser (RFC 8291), which the service cannot read. | The browser maker's choice. | Other recipient |
| Crisp (website chat) Crisp IM SAS (France) | The website chat button, only after a visitor presses it. | What a visitor types and any email they give. | European Union (per Crisp's privacy page). | Subprocessor |
| U.S. Census Bureau geocoder U.S. Census Bureau | Turns restaurant addresses from health departments' public inspection data into map points; and, only when a visitor taps Use my location, says which state and county a point is in. | Public business addresses; a visitor's point rounded to about 100 meters, only after their tap, never kept. No account holder's data. | United States. | Other recipient |
What we checked
What we do not use
- Analytics SDKs (no PostHog, Google Analytics, Segment, Sentry).
- Ad networks.
- Data brokers.
- Cloudflare (not in our configuration).
- Google Fonts (our fonts are served from our own server since 2026-10-08).
Changes
Hearing about a change
Business customers with a data processing addendum get an email 30 days before a new subprocessor starts, and can object. Everyone can read the list here.
Your binder is ready when the inspector is.
Pick your place. Start with one shift.
Start your 25 days free See it work
25 days free. Cancel anytime.
Questions? Call or text (415) 640-1667