Legal
Service Providers & Subprocessors
Last updated: August 2026
Invitely uses the providers below to host, store, authenticate, and deliver the service. Not every provider acts as a GDPR subprocessor in every context — for example, Google OAuth is a sign-in service provider, while Supabase and Resend process personal data on our behalf.
Production beta infrastructure is intended to use Supabase PostgreSQL in the EU (Stockholm) and Vercel Pro for hosting. Where a provider processes data outside the EU/EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or provider DPAs where available on the relevant plan.
| Provider | Role | Purpose | Location | Transfers |
|---|---|---|---|---|
| Vercel | Hosting | Application hosting and deployment | United States (primary processing); EU edge where configured | Standard Contractual Clauses where required |
| Supabase | Subprocessor | PostgreSQL database hosting | EU (Stockholm, eu-north-1) | Not applicable for EU-hosted project data |
| Resend | Subprocessor | Transactional email delivery | United States | Standard Contractual Clauses / DPA where required |
| Service provider | Optional OAuth sign-in | United States / global | Google’s contractual safeguards where applicable |
This list reflects the current beta stack. It may change as providers are added or replaced. Material updates will be reflected here. For how personal data is handled, see our Privacy Policy.
Privacy · Terms · Cookies · Service providers