Places Platforms Pty Ltd (“Places”) uses carefully selected third-party service providers - known as subprocessors - to help us operate, secure, and improve our products and services.

These subprocessors may process, store, or have access to limited personal information as part of their service delivery.

We only engage partners who meet strict security and privacy standards and who are bound by written data-processing agreements consistent with the Australian Privacy Principles (APPs) and other applicable laws.

A subprocessor is a third-party company engaged by Places that processes personal data on our behalf, in order to provide specific parts of our platform’s functionality - such as hosting, authentication, analytics, or delivery of content.

Subject matter, nature & duration of processing: Provides compute infrastructure and cloud storage for application data and media content. AWS processes and stores data to host and deliver the Places platform and related services for as long as the platform is active.

Location: Australia

Adequacy Mechanism Supporting Transfer: Standard Contractual Clauses (EU 2021/914) and equivalent safeguards for global data transfers consistent with GDPR and APP 8.

Subject matter, nature & duration of processing: Provides user authentication and identity management. Clerk processes email addresses, passkey credentials, and session metadata to enable secure sign-in and user verification for the duration of a user’s account.

Location: United States

Adequacy Mechanism Supporting Transfer: Standard Contractual Clauses (EU 2021/914) and equivalent safeguards for global data transfers consistent with GDPR and APP 8.

Subject matter, nature & duration of processing: Provides content delivery, caching, cloud compute, storage and security services. Cloudflare processes IP addresses, request logs, and cached site data to improve performance and protect the platform from malicious traffic, retained only as necessary for security operations.

Location: Global

Adequacy Mechanism Supporting Transfer: Standard Contractual Clauses (EU 2021/914) and equivalent safeguards for global data transfers consistent with GDPR and APP 8.

Subject matter, nature & duration of processing: Provides error-tracking and crash analytics. Sentry processes diagnostic data and technical logs to identify, monitor, and resolve software issues. Data is stored for a limited period required for debugging and product stability.

Location: United States

Adequacy Mechanism Supporting Transfer: Standard Contractual Clauses (EU 2021/914) and equivalent safeguards for global data transfers consistent with GDPR and APP 8.

Provides cloud compute and backup services used by certain application components. GCP processes platform data and system backups as required for service continuity and reliability.

Location: Australia

Adequacy Mechanism Supporting Transfer: Standard Contractual Clauses (EU 2021/914) and equivalent safeguards for global data transfers consistent with GDPR and APP 8.

Provides product and usage analytics. Posthog processes anonymised or aggregated event data and user interactions to help improve user experience and feature design, retained only for analytic trend analysis.

Location: United States

Adequacy Mechanism Supporting Transfer: Standard Contractual Clauses (EU 2021/914) and equivalent safeguards for global data transfers consistent with GDPR and APP 8.

Subject matter, nature & duration of processing: Provides managed database hosting, compute, and file storage services. Supabase processes user account information, community data, and authentication metadata necessary for the functioning of the Places platform, stored for the life of the service unless deleted or anonymised.

Location: Australia

Adequacy Mechanism Supporting Transfer: Standard Contractual Clauses (EU 2021/914) and equivalent safeguards for global data transfers consistent with GDPR and APP 8.

We select subprocessors based on:

• Proven data-protection and reliability standards
• Transparent security and privacy practices
• Compliance with global frameworks (e.g. GDPR, ISO 27001)

Before engaging any new subprocessor, we review their privacy and security measures to ensure alignment with our obligations and values.

We may update this list as our platform evolves.

When we add or replace a subprocessor, we’ll update this page to reflect the change.

Significant updates - such as new providers processing personal information - will be communicated through our website or in-app notifications.

If you have any questions about our subprocessors or how your data is handled, please contact us at: support@places.cc.