Baseline text pending counsel review
This text describes what the service actually does today and is published so that pilot participants can read it before providing personal data or payment. It has not yet been reviewed by a lawyer for the operator's jurisdiction.
Subprocessors
Last updated 14 September 2026
These are the only third parties that process personal data on behalf of CrownVouch. Business account owners are emailed at least 14 days before a provider is added or replaced, as set out in the data processing agreement.
Current subprocessors
| Provider | Purpose | Data | Location | Safeguard |
|---|---|---|---|---|
| PostgreSQL database and application hosting | Operator-managed infrastructure | All application data described in the privacy notice | not yet configured | Operator's own infrastructure or hosting agreement |
| Resend, Inc. | Transactional email delivery | Recipient address, sender identity, subject, message body and delivery events for review requests, reminders, sign-in and notification email | United States | Resend data processing terms |
| Polar Software Inc. | Billing, subscriptions and payments (merchant of record) | Business billing contact, subscription status and payment method on Polar's hosted pages; card details never reach CrownVouch | United States | Polar terms and data processing terms |
| Twilio Inc. | Text-message delivery for businesses that add the SMS add-on | Recipient mobile number, message body and delivery status for review requests and reminders; inbound STOP/HELP replies | United States | Twilio data protection addendum |
| Postmark (ActiveCampaign, LLC) | Inbound email processing for forwarded invoices | Forwarded invoice emails: sender, subject, message id and the customer address they contain | United States | Postmark data processing terms |
| Google LLC | Optional sign-in (OAuth) and Business Profile reviews sync when a business connects its profile | Google account identifier, email address and verification state on sign-in; for a connected Business Profile, the business's own public reviews and an offline access token | United States / global | Google API Services User Data Policy |
What we do not use
- No advertising networks, tracking pixels or cross-site analytics on any page.
- No session replay on customer-facing pages.
- No AI or data-enrichment providers receive customer feedback or identities.
- No native connections to invoicing or payment vendors; businesses send events to us.