Subprocessor List

Last Updated: 22 May 2026

This is the list of third-party service providers (“subprocessors”) that Crowdify Pty Ltd (ABN 47 692 719 305) uses to operate the Platform. Each subprocessor is bound by a written agreement (or its published equivalent) to handle personal information confidentially and only for the purposes described below. See our Privacy Policy for more on how we share personal information.

Supabase

Supabase Inc.

Purpose: Managed PostgreSQL database, authentication, file storage, and realtime services

Data types: All Account data; salted password hashes; Event content; community posts; direct messages; uploaded files (event images, profile photos); transaction records

Location: United States (Supabase corporate); Australia (database hosted in AWS ap-southeast-2 Sydney)

Vercel

Vercel Inc.

Purpose: Hosting and content delivery for the Crowdify web application; serverless function execution; edge caching

Data types: Request/response metadata (IP address, user agent, URL paths); session cookies in transit

Location: United States (corporate); global edge network including Sydney region

Stripe

Stripe Payments Australia Pty Ltd (ABN 88 600 314 140, AFSL #500105)

Purpose: Card payment processing, payouts to Organisers (Stripe Connect Express), Organiser KYC/AML verification

Data types: Card numbers and CVV (Stripe only — never seen by Crowdify); transaction metadata; Organiser identity documents and bank-account details; risk and fraud signals

Location: Australia (regulated entity); processing infrastructure in the United States and Ireland

Brevo (Sendinblue)

Sendinblue SAS

Purpose: Transactional email delivery (ticket confirmations, refund notifications, password resets, security alerts); marketing email delivery where you have opted in

Data types: Email address; first/display name; email engagement metrics; marketing-consent state

Location: France and Germany (European Union)

FingerprintJS Pro

FingerprintJS, Inc.

Purpose: Anti-fraud device and browser fingerprinting; multi-account abuse detection; self-funding prevention on Crowdfunded Events

Data types: Browser and device signals; pseudonymous "visitor ID"; confidence score

Location: United States (corporate); regional infrastructure including Asia-Pacific

Twilio

Twilio Inc.

Purpose: Phone-number lookup and validation when you add or verify a phone number on the Platform

Data types: Phone number; line type; carrier; country

Location: United States

PostHog

PostHog Inc.

Purpose: Product analytics — page views and feature usage; helps us improve the Platform. Session replay is disabled.

Data types: Pseudonymous user identifier; page paths; event names and properties; device type; browser type; consent state

Location: United States and European Union (we have configured the EU region where supported)

Apple Push Notification Service (APNs)

Apple Inc.

Purpose: Delivery of push notifications to the Crowdify iOS application

Data types: iOS device push token; notification payload (no card data, no password, no government ID)

Location: United States; global Apple infrastructure

Firebase Cloud Messaging (FCM)

Google LLC

Purpose: Delivery of push notifications to the Crowdify Android application

Data types: Android device push token; notification payload

Location: United States; global Google infrastructure

International data transfers

Several subprocessors are located outside Australia. We rely on APP 8.2 reasonable steps, contractual commitments, and (where available) industry certifications (PCI-DSS, SOC 2, ISO 27001) to ensure overseas recipients do not breach the Australian Privacy Principles. See the Privacy Policy section 11 for more.

Changes to this list

We may add or change subprocessors from time to time. Material changes (adding a new subprocessor or changing one in a material way) will be notified by email to Account holders at least 14 days before the change takes effect, except where the change is urgent for security or legal reasons. The “Last Updated” date at the top of this list will be revised on each change.

Contact

Subprocessor questions and objections: privacy@crowdify.com.au