Service providers and subprocessors

1. Scope of this list

BusinessMode uses the providers below to operate its service. A provider is a Customer's subprocessor only to the extent it processes personal data BusinessMode handles on that Customer's behalf. Some providers also support BusinessMode's own account, billing, security or website purposes, and some have independent-controller responsibilities. The applicable role depends on the function and data involved.

This list accompanies the Data Processing Agreement, Privacy Policy and Cookie Policy. BusinessMode is operated by Frej Dahl Linneke in Denmark. Privacy and provider enquiries: [email protected].

2. Core infrastructure and service delivery

Supabase

Function: PostgreSQL database, account authentication and private storage for personal-data exports.

Relevant information: account and authentication information, Customer-supplied access-management data, memberships, invitations, audit records and export artifacts, according to the function used.

Confirmed production database region: EU Ireland. The selected database region does not, by itself, describe every support, logging, backup or onward-processing location.

Hetzner

Function: application hosting for BusinessMode services.

Relevant information: data processed by the hosted applications and technical request or operational information.

Confirmed application-hosting region: EU-central.

Resend

Function: transactional email, including supported invitation workflows.

Relevant information: recipient addresses, message content needed for the communication and delivery information. Removing an invitation from BusinessMode does not automatically erase a message already delivered or the provider's own records.

Sentry

Function: error monitoring and diagnostics.

Relevant information: minimized technical errors and operational context. BusinessMode's instrumentation removes sensitive user context and request content where configured, but provider network metadata and residual diagnostics can still be personal data. Its subprocessor role applies where diagnostics contain covered Customer data.

3. Payments, analytics and editorial services

Stripe

Function: BusinessMode subscription billing and, when enabled by a Customer, hosted payment and merchant connection workflows.

Relevant information: billing contacts, merchant and payment references, subscription or invoice information and payment status. Card entry takes place in Stripe-hosted interfaces. Stripe's role and retention depend on the payment service; some processing is carried out under its own legal and regulatory responsibilities. BusinessMode's DPA does not replace a Customer's separate agreement with Stripe.

PostHog

Function: product and website measurement, with optional persistent browser analytics and masked session replay controlled by the analytics choice.

Relevant information: minimized events, sanitized page paths, technical context and internal identifiers where enabled. Basic cookieless measurement can continue before opt-in and after choosing No. BusinessMode's own measurement purposes are described in the Privacy Policy; the provider acts as a Customer subprocessor only where the particular processing is on that Customer's behalf.

Sanity

Function: editorial content management and delivery for public guides, legal pages, announcements and other published content.

Relevant information: editorial content, contributor information and related service metadata. Sanity is not the primary store for Customer access-management records. Its use for editorial purposes does not make it a subprocessor for every Customer dataset.

4. Locations and transfers

The infrastructure regions stated above are the confirmed production database and application-hosting locations. They are not a claim that every listed provider stores or accesses all information only in Denmark or the EEA. Other provider functions, support and onward processing can involve additional countries.

Where a restricted international transfer occurs, the applicable legal transfer mechanism and any necessary supplementary measures must be in place. Contact [email protected] for information about a particular provider, the processing relevant to your account and the applicable safeguards. A provider's brand or an EU hosting selection is not proof that all transfer requirements have been satisfied.

5. Changes and objections

For processing covered by the DPA, BusinessMode will provide advance written notice through the Customer's account contact before adding or replacing a subprocessor, with a reasonable opportunity to raise a substantiated data-protection objection before the change takes effect. BusinessMode will consider the objection and seek a compliant arrangement as described in the DPA.

This list describes provider functions. It does not expand the Customer's processing instructions, authorize unrelated uses of personal data or state that publication alone executes a processing agreement.

6. Retention and requests

Provider-held information follows the applicable processing arrangement and retention obligations. Application deletion, a submitted provider request and confirmed provider erasure are distinct stages. Copies in backups, delivered emails and records retained for legal obligations may require separate handling. The Privacy Policy describes retention criteria and the application cleanup periods that apply to particular records.

To request provider information or assistance with a return or deletion request, contact [email protected].