Legal

Sub-processors

Version 0.1

Named in our Privacy Policy and in the merchant Data Processing Addendum.

This register names every external service that Fidella hands customer data to, what data reaches it, where it is processed, and on what contractual footing. New Zealand's Privacy Act 2020 does not require a public register the way the GDPR does, but Information Privacy Principles 4, 5, 9 and 11 oblige us to know who we share data with, what leaves, which region it lives in, and under which contractual control. This page is that record, published so that the people whose data it describes can read it.

We keep it current: a provider is added here before the integration that uses it goes live, and a provider we stop using is removed. Merchants can object to a change on reasonable data-protection grounds under the Data Processing Addendum.

If we expand into a jurisdiction where the GDPR applies we will move to signed Data Processing Agreements and note each one against its row below. Until then, "Accepted (vendor terms)" is the contractual baseline we rely on.

How to read this register

Data shared — the categories of customer data that actually leave Fidella's database for this processor. It excludes data we hold but never transmit to that processor.
Region — where the processor stores or processes the data. Where a vendor offers regional pinning we note the configured region; otherwise "vendor-default".
Status — whether we have evaluated and accepted the vendor's privacy commitments. "Accepted (vendor terms)" means we rely on the vendor's published privacy and processing terms, which is the New Zealand Privacy Act baseline. "Signed DPA" means we additionally hold an executed Data Processing Agreement, which is what we would need before processing EU or EEA data through that vendor.

Sub-processors

Processor: Auth0 (Okta)
Data shared: Identity: email, name, auth0_id. JWT-claim profile fields.
Region: Default tenant region per configured tenant.
Status: Accepted (vendor terms).

Processor: Stripe
Data shared: Financial: payment-intent IDs, customer-ref tokens, refund tokens, last-4 of card (never the full card number).
Region: US (Stripe global).
Status: Accepted (vendor terms).

Processor: Sentry
Data shared: Error context after capability-token, URL-credential, Auth0 identifier, IP, email and profile-field scrubbing.
Region: Default Sentry SaaS region (US).
Status: Accepted (vendor terms).

Processor: Mixpanel
Data shared: Behavioural events keyed by auth0_id. Consent-gated: they are only sent for customers who have accepted analytics.
Region: US (Mixpanel default). EU residency available if we ever need it.
Status: Accepted (vendor terms).

Processor: Google Analytics 4
Data shared: Device and interaction events, anonymised client ID. Consent-gated by the in-app banner.
Region: US (Google global).
Status: Accepted (vendor terms).

Processor: Resend
Data shared: Recipient email and first name for transactional email (signup confirmation, password reset, transfer notifications).
Region: Provider-default.
Status: Accepted (vendor terms).

Processor: Cloudinary
Data shared: Customer-uploaded images, and staff proof-of-purchase evidence. Evidence is scoped to the venue that captured it and is never delivered through an unsigned public URL.
Region: Cloudinary global CDN.
Status: Accepted (vendor terms).

Processor: Mapbox
Data shared: Your device's IP address at the moment map tiles are fetched, issued by your browser directly to Mapbox when the Discover map renders. Nothing is handed over by our servers.
Region: US (Mapbox global).
Status: Accepted (vendor terms).

Processor: Apple Wallet
Data shared: Device library identifier and push token for an issued wallet pass. No name, no email.
Region: Apple (US).
Status: Accepted (vendor terms, Apple Developer Program licence agreement).

Processor: Google Wallet
Data shared: Pass class identifier and push registration for an issued wallet pass.
Region: Google (US).
Status: Accepted (vendor terms).

Processor: Railway
Data shared: Database hosting, which means the full Fidella database including personal information, at rest; and backend container logs.
Region: Railway-selected region (currently us-west).
Status: Accepted (vendor terms, Railway security commitments).

Processor: Vercel
Data shared: Frontend hosting. Receives request URLs, headers and IP addresses in its edge logs. Does not see Auth0 or Fidella backend data.
Region: Vercel global CDN.
Status: Accepted (vendor terms).

Processor	Data shared	Region	Status
Auth0 (Okta)	Identity: email, name, `auth0_id`. JWT-claim profile fields.	Default tenant region per configured tenant.	Accepted (vendor terms).
Stripe	Financial: payment-intent IDs, customer-ref tokens, refund tokens, last-4 of card (never the full card number).	US (Stripe global).	Accepted (vendor terms).
Sentry	Error context after capability-token, URL-credential, Auth0 identifier, IP, email and profile-field scrubbing.	Default Sentry SaaS region (US).	Accepted (vendor terms).
Mixpanel	Behavioural events keyed by `auth0_id`. Consent-gated: they are only sent for customers who have accepted analytics.	US (Mixpanel default). EU residency available if we ever need it.	Accepted (vendor terms).
Google Analytics 4	Device and interaction events, anonymised client ID. Consent-gated by the in-app banner.	US (Google global).	Accepted (vendor terms).
Resend	Recipient email and first name for transactional email (signup confirmation, password reset, transfer notifications).	Provider-default.	Accepted (vendor terms).
Cloudinary	Customer-uploaded images, and staff proof-of-purchase evidence. Evidence is scoped to the venue that captured it and is never delivered through an unsigned public URL.	Cloudinary global CDN.	Accepted (vendor terms).
Mapbox	Your device's IP address at the moment map tiles are fetched, issued by your browser directly to Mapbox when the Discover map renders. Nothing is handed over by our servers.	US (Mapbox global).	Accepted (vendor terms).
Apple Wallet	Device library identifier and push token for an issued wallet pass. No name, no email.	Apple (US).	Accepted (vendor terms, Apple Developer Program licence agreement).
Google Wallet	Pass class identifier and push registration for an issued wallet pass.	Google (US).	Accepted (vendor terms).
Railway	Database hosting, which means the full Fidella database including personal information, at rest; and backend container logs.	Railway-selected region (currently us-west).	Accepted (vendor terms, Railway security commitments).
Vercel	Frontend hosting. Receives request URLs, headers and IP addresses in its edge logs. Does not see Auth0 or Fidella backend data.	Vercel global CDN.	Accepted (vendor terms).

Geolocation, which is not in use

Fidella can be configured to look up the country an IP address belongs to, for the regional rules that govern stored value. That integration is disabled, no provider is engaged for it, and nothing is sent anywhere. If we ever turn it on, the provider will be named in the table above, and the lookup will run only with request-scoped consent, will be reduced to a country and country code, and the IP address will not be stored by us.