Subprocessors Notice

1. Current service providers

• Vercel — hosts and delivers the Next.js application and processes request/runtime logs needed to operate and secure it. Website: vercel.com.
• Supabase — provides PostgreSQL, authentication and private file Storage. The production project is configured as: us-west-2 (United States). Website: supabase.com.
• Resend — sends transactional authentication email such as invitations and password-recovery messages. Website: resend.com.

2. Data involved

A provider receives only the categories needed for its function. Hosting and database providers may process Client Data and technical logs. The email provider processes recipient address, message content and email-delivery metadata for transactional messages.

3. Location and retention

• Supabase project region: us-west-2 (United States)
• Application/authentication/security log retention: Avyukta currently operates the application on Vercel Pro and the database on Supabase Pro. Vercel Pro runtime logs are available for 1 day, and Supabase Pro logs are available for 7 days. Vercel and Supabase maintain platform security, encryption, access-control, monitoring and compliance safeguards, while Avyukta applies application-level authorization and security controls under a shared-responsibility model. No safeguard eliminates all risk, and retention periods may change if provider plans or configurations change.
• Resend transactional email retention: Resend retains email and log data for 30 days while the account is active on Free, Pro and Scale plans, and its backups persist for 7 days. When the account is terminated, Resend states that remaining user and customer data is deleted within 90 days, subject to its agreement and applicable law.
• The providers may use additional infrastructure providers and may process information outside Canada. No Canada-only residency representation is made.

4. Changes

Avyukta will update this notice before adding a provider that materially changes how Client Data is processed. Contractual notice obligations, if any, are governed by the applicable written agreement with the Client.