Legal
Subprocessors
Last updated September 27, 2026
Bossy uses a small set of trusted third-party providers ("subprocessors") to deliver the service. Each provider in the table below is bound by contract to protect personal data. Some may also use personal data for their own purposes, such as preventing fraud, securing their service, or improving their products, as their own terms allow. This list may change as our infrastructure evolves; material additions are reflected here.
Current subprocessors
| Provider | Purpose | Data processed |
|---|---|---|
| Supabase | Database, authentication, and file storage | Account data, app content (including task photos), authentication data |
| Vercel | Application hosting and content delivery | Request/log data, usage data |
| Stripe | Payment processing and subscription billing | Billing contact and payment data (card data is held by Stripe; Bossy does not store full card numbers) |
| Resend | Transactional and marketing email delivery | Recipient email, email content, and our email contact list (name, email address, and whether the person has unsubscribed) |
| Twilio | SMS and WhatsApp notification delivery. Meta (WhatsApp) carries the WhatsApp messages as Twilio's own subprocessor | Mobile number, message content (where the SMS/WhatsApp feature is enabled) |
| Sentry | Error monitoring and diagnostics | Diagnostic and limited event data |
| PostHog | Product analytics | Usage events, device/approximate-location data |
| HeyCatch | Product analytics | Usage events, user identifiers (name, email), plan tier |
| Shopify | Subscription billing for customers who install Bossy from the Shopify App Store; store integration | Billing contact and subscription status (Shopify-billed customers). Order/inventory data flows inbound from the customer's own store; Bossy sends no employee or shopper personal data to Shopify |
| Microsoft 365 (Microsoft, purchased through GoDaddy) | Bossy's company email, including support@bossyhq.com, privacy@bossyhq.com and hello@bossyhq.com: support requests, privacy and deletion requests, and the team's internal alerts, which can include what a customer wrote in a support ticket | Names, email addresses, message content |
| Google Firebase Cloud Messaging | Push notifications to the Bossy mobile apps. On iPhones and iPads, Google passes each notification to Apple Push Notification service, which delivers it under Apple's developer terms. Those terms say the service is not a guaranteed or secure delivery service, and the contract commitment above the table does not cover Apple | Device tokens, notification text (which can include names), and the ids the app uses to open the right screen |
| Mapbox | Maps and address search when an owner or manager pins a location or job site for the time clock | Addresses they search for; their browser's IP address and the map area it loads; a random identifier that the map stores in their browser, replaces after 24 hours, and sends to Mapbox when a map loads |
Restaurant ordering sites
Bossy also builds and runs online-ordering websites for restaurants. On those sites the restaurant is the controller of its diners' data and Bossy is its processor, as our Privacy Policy explains. Providers that receive diners' data on those sites under their own terms include the two below; the ordering-sites section of our Privacy Policy describes the others. The two below are not subprocessors under our Data Processing Addendum, and the contract commitment stated above the table does not apply to them.
- Meta (WhatsApp): when an ordering site sends a diner a WhatsApp message, the message goes out from the restaurant's own WhatsApp Business account, under the terms between the restaurant and Meta. Meta receives the diner's WhatsApp number and the message.
- Google Maps Platform: when an ordering site suggests addresses as a diner types and finds the map coordinates of the one they choose, Google provides that service. Google acts as an independent controller under the Google Maps Platform terms. It receives what the diner types, the diner's IP address, and map coordinates, and it may use that data to provide and improve its own products.
Our marketing website
Our marketing website (bossyhq.com) uses Microsoft Advertising to measure which of our ads lead to new Bossy accounts and to show our ads to people who have visited the site. Microsoft acts as an independent controller under its own terms. It is not a subprocessor under our Data Processing Addendum, and the contract commitment stated above the table does not apply to it. It receives visitors' IP addresses, browser details, the pages they visit on our marketing website, and a record that an account was created; it does not receive what customers or their team members put into Bossy. Our Cookie Policy describes the cookies and how to opt out.
Hosting region
Data is processed primarily in the United States.
Notification of changes
To be notified of new subprocessors, contact privacy@bossyhq.com. Customers may raise reasonable objections to a new subprocessor as described in our Data Processing Addendum.
Changes to this list
September 27, 2026. We added the section on our marketing website, which describes Microsoft Advertising.
September 25, 2026. We added Microsoft 365, Google Firebase Cloud Messaging, and Mapbox. We were already using all three and had left them off this list by mistake. Customers can object to any of them as our Data Processing Addendum describes. We also added Meta's role to the Twilio row, added the section on restaurant ordering sites, and described more fully the data that Resend and Mapbox hold. We corrected the paragraph above the table, too: it said that every provider uses personal data only to provide their service to us, but some providers' terms let them use data for their own purposes.
September 2, 2026. We added Shopify.
August 24, 2026. We added HeyCatch.