Legal
Sub-processors
Last updated: 7 September 2026
We use a deliberately small set of third-party providers (“sub-processors”, or “sub-operators” in POPIA terms) to run Pinion CRM. This is the complete list — there are no analytics providers, no advertising networks, and no email marketing tools. Each provider processes data only as needed for the purpose listed. This page supports our Operator Agreement and Privacy Policy; when the list changes, we update this page and its date.
| Provider | What it does | Where data is processed |
|---|---|---|
| Supabase | Database, authentication, and file storage (all account data and customer content, including job photos) | eu-west-1 region — Republic of Ireland (EU) |
| Cloudflare | Website and application hosting, content delivery network, DNS | Global edge network (Cloudflare, Inc., USA) |
| Paystack | Payment processing for paid subscriptions. We share the account owner's email address (tagged per business, so each business has its own Paystack customer) so Paystack can send receipts; card details go directly to Paystack and never touch our servers | South Africa / Nigeria (Paystack, a Stripe company) |
| Optional “Sign in with Google” authentication (name and email address of users who choose it) | Global (Google LLC, USA) |
Questions about any of these providers? Email privacy@pinioncrm.com.