Sub-Processor List
Last updated: March 2026
ThinQr uses the following third-party service providers (sub-processors) to deliver our services. Each sub-processor is listed with their purpose, location, and the type of data they process.
| Sub-Processor | Purpose | Location | Data Processed |
|---|---|---|---|
| Supabase | Database, Authentication, File Storage | EU (Frankfurt, Germany) | All application data including user profiles, employee records, training content, business process maps |
| Vercel | Application Hosting, Edge Functions | EU (Frankfurt, Germany) | Request metadata, server-rendered pages |
| Anthropic (Claude) | AI Training Generation, Business Mapping, Contract OCR | United States | Business descriptions, station task definitions, training content, contract text. No employee personal data is sent to AI. |
| OpenAI | Text Embeddings for Document Search | United States | Text chunks for semantic search (business content only, no personal data) |
| Resend | Transactional Email | United States | Email addresses, notification content |
| Stripe | Payment Processing, Subscription Management | United States / EU | Billing information, payment methods, subscription data |
| Upstash | Rate Limiting, Security | EU (Frankfurt, Germany) | Hashed user identifiers, request counts (24-hour retention) |
Data Transfer Safeguards
For sub-processors located outside the European Economic Area (EEA), ThinQr relies on Standard Contractual Clauses (SCCs) as approved by the European Commission to ensure adequate protection of personal data transfers. This applies to Anthropic, OpenAI, Resend, and Stripe.
Changes to Sub-Processors
ThinQr will update this page when sub-processors are added, removed, or changed. Customers with an active Data Processing Agreement (DPA) will be notified of material changes to this list.
Questions
For questions about our sub-processors or data processing practices, contact us at privacy@thinqr.com.