Subprocessor List
Version 2.1Effective October 5, 2026Current policy
On this page
ChemCal Pro Subprocessors and Service Providers
Version 2.1 | Effective date: October 5, 2026
Application of this version. This version applies when made available and incorporated into the customer agreement through the applicable notice and acceptance process. The effective date above does not establish earlier acceptance or change rights that have already accrued.
---
1. What this registry is
1.1 This is the single, versioned list of the third-party providers ChemCal Pro LLC ("ChemCal Pro") engages, what each one does, what categories of information it handles, and the role it holds. Providers used only for ChemCal Pro's own internal review of manufacturer reference material are identified by category in Section 5.7 rather than by name.
1.2 Section 4 of this registry is Annex 3 to the ChemCal Pro Data Processing Addendum. The providers in Section 4 are the subprocessors a customer authorizes when it accepts the Terms of Service, subject to the notice and objection process in Section 7 below.
1.3 The providers in Section 5 handle personal information for which ChemCal Pro, or the provider itself, is the controller — not information held in a customer's account on that customer's instructions. They are listed for transparency under the Privacy Notice. Section 5.6 explains the one condition on which a Section 5 provider can also become a subprocessor.
1.4 A provider is listed because it is in use today, not because ChemCal Pro might use it in future.
---
2. Roles, and how to read them
| Role | What it means here |
|---|---|
| Subprocessor | The provider processes Customer Personal Data — data held in a customer's account and processed on that customer's instructions — on ChemCal Pro's instructions |
| Processor for ChemCal Pro's own data | The provider processes personal data for which ChemCal Pro is the controller, such as billing records, prospect records or marketing enquiries. This is not, by itself, subprocessing of Customer Personal Data |
| Independent role | The provider determines the purposes and means of some of its own processing, for its own legal, fraud-prevention, security or product purposes, and is not acting only on ChemCal Pro's instructions for that part |
| Dual role | The provider does more than one of the above, for different processing |
The boundary that decides which section a provider sits in is whether the provider actually processes customer-directed data from a customer's account — not whether a customer's employee happens to have interacted with the provider's service. A customer's administrator booking a call does not, by that fact alone, turn the scheduling platform into a subprocessor. Section 5.6 states when it does.
---
3. Provider arrangements and processing locations
Provider legal domicile is different from the location where information is processed. Providers and their subprocessors may process information in multiple countries for hosting, delivery, support and resilience. ChemCal Pro does not make an exclusive data-residency commitment. A regional account URL or storage location hint is not a guarantee of country-exclusive processing.
The provider links below describe their published terms and practices. They do not replace ChemCal Pro's obligations under the Data Processing Addendum. Service-specific contracting entities and processing arrangements are governed by the applicable provider agreements. Contact us under Section 9 for information about arrangements relevant to your account.
---
4. Subprocessors — providers that process Customer Personal Data
4.1 Supabase Pte. Ltd.
| | |
|---|---|
| Legal domicile | Singapore |
| What it does for us | Database, account authentication, file storage, provider-managed backups, and security and logging |
| Categories handled | Substantially all application data: account and identity, authentication and session, membership and role, member profile photographs, credential records and credential proof documents, product and document records, calculator records, publication records, legal acceptance records, audit records, and technical and security data |
| Role | Subprocessor |
| Processing location | The provider's platform supports regional project configuration, and provider support and the provider's own subprocessors may operate elsewhere under its terms |
| Provider documentation | Supabase DPA |
4.2 Vercel Inc.
| | |
|---|---|
| Legal domicile | United States |
| What it does for us | Application hosting and delivery, and security logging |
| Categories handled | Requests and responses passing through the application; account and service data in transit; IP address; browser and device information; request, error, deployment and security metadata |
| Role | Subprocessor |
| Processing location | Delivery and support locations are global under the provider's terms |
| Provider documentation | Vercel DPA · Vercel Terms |
4.3 Plus Five Five, Inc. (trading as Resend)
| | |
|---|---|
| Legal domicile | United States |
| What it does for us | Transactional and authentication email delivery, including sign-in links, account invitations and service messages |
| Categories handled | Recipient email address, sender and message metadata, delivery status, and the content of the transactional messages ChemCal Pro sends — which can include a single-use sign-in link |
| Role | Subprocessor |
| Processing location | The provider's published privacy documentation describes United States processing. Account-specific processing locations are not specified in this registry |
| Provider documentation | Resend DPA · Resend Privacy |
4.4 Functional Software, Inc. (trading as Sentry)
| | |
|---|---|
| Legal domicile | United States |
| What it does for us | Application error monitoring, performance monitoring, and error-triggered session replay |
| Categories handled | Error and performance event data, technical and route metadata, correlation identifiers, release and environment identifiers, and masked error-triggered replay data. ChemCal Pro's configuration excludes user identity, cookies, request and response headers and bodies, URL query parameters, database values and local variables, and removes free-text content before transmission. Page addresses and comparable technical metadata can be present in replay data, as described in the Privacy Notice |
| Role | Subprocessor |
| Processing location | Account-specific processing locations are not specified in this registry |
| Provider documentation | Sentry DPA · Sentry Replay privacy |
| Retention | Retention depends on the category of monitoring data and our provider account configuration. Contact us for the applicable period |
4.5 Cloudflare, Inc.
| | |
|---|---|
| Legal domicile | United States |
| What it does for us | Backup storage for ChemCal Pro's own scheduled copies of application data and stored files |
| Categories handled | Copies of substantially all application data and stored objects, including member profile photographs and credential proof documents |
| Role | Subprocessor |
| Processing location | Account-specific processing locations are not specified in this registry. A storage location setting is not a contractual residency guarantee, and ChemCal Pro does not present it as one |
| Provider documentation | Cloudflare DPA |
| Note | Retention of these copies is described in the Privacy Notice and in the Data Processing Addendum. A documented retention and disposal schedule is being established |
4.6 GitHub, Inc.
| | |
|---|---|
| Legal domicile | United States |
| What it does for us | Source-code hosting, and processing of ChemCal Pro's scheduled production backups |
| Categories handled | During a backup, copies of substantially all application data and stored files, together with the service-authentication information needed to complete the backup. Source code itself contains no customer personal data |
| Role | Subprocessor, for backup processing |
| Processing location | Provider-operated infrastructure. No processing region is specified, and ChemCal Pro makes no residency commitment |
| Provider documentation | GitHub customer terms · GitHub Privacy |
| Scope | The subprocessor role covers backup processing that handles production data; ordinary source-code hosting is a separate function |
---
5. Providers that process personal data for which ChemCal Pro or the provider is the controller
5.1 Stripe
| | |
|---|---|
| Legal entity | Stripe group. The service-specific contracting entity is identified in the applicable Stripe agreement |
| What it does for us | Payment processing, hosted checkout, subscription management, the hosted customer billing portal, refunds, and payment event notifications |
| Categories handled | Payment method details entered on the provider's own hosted pages, billing name and address, email address, subscription and invoice records, transaction and event metadata |
| Role | Dual role. Processor for ChemCal Pro's own billing and subscription records — for which ChemCal Pro is the controller under the Data Processing Addendum, Section 2.4 — and an independent controller for its own purposes, which include fraud detection and prevention, legal and regulatory compliance, and its own product and relationship purposes |
| Processing location | Account-specific processing locations are not specified in this registry |
| Provider documentation | Stripe DPA |
| Note | ChemCal Pro does not receive, display or store complete card or bank-account numbers. It is not the case that this provider receives only anonymous data |
5.2 Google Workspace, Gmail, Calendar and Meet
| | |
|---|---|
| Legal entity | Google group. The Workspace contracting entity is identified in the applicable subscription agreement |
| What it does for us | ChemCal Pro's business email — including the monitored `support@chemcalpro.com` mailbox — calendar, and video meetings |
| Categories handled | Support and other correspondence, including anything a sender chooses to include; meeting invitations, attendee details and meeting links |
| Role | Processor for ChemCal Pro's own support and meeting correspondence, which the Data Processing Addendum, Section 2.4 identifies as ChemCal Pro's independent-controller purpose. See Section 5.6 for when this becomes subprocessing |
| Processing location | Provider-operated infrastructure, global under the provider's terms. Account-specific processing locations are not specified in this registry |
| Provider documentation | Google data-processing terms |
| Separate matter — Google as a sign-in provider | Where an invited user chooses to sign in with a Google account, Google acts in its own right for that user's own Google account and Google's own processing. ChemCal Pro's authentication provider receives the sign-in result, identity identifier, email and associated basic profile claims, which can include a name and profile image. This does not give the application access to the user's mailbox, contacts or calendar |
5.3 HubSpot, Inc.
| | |
|---|---|
| Legal domicile | United States |
| What it does for us | Customer-relationship records for prospects and customers, and the meeting-scheduling page at `meet.chemcalpro.com/consultation` |
| Categories handled | Business contact details; the details a person enters when booking, as itemised in the Privacy Notice; meeting scheduling and outcome records; and the analytics and visitor-tracking storage the platform sets on the scheduling page |
| Role | Processor for ChemCal Pro's own prospect, relationship and scheduling records. A customer's user booking a call does not by itself make this provider a subprocessor — see Section 5.6 |
| Processing location | Provider-operated infrastructure, which the provider's own documentation describes as potentially global. A regional account URL does not establish exclusive residency, and ChemCal Pro does not claim it does |
| Provider documentation | HubSpot DPA · HubSpot subprocessors |
5.4 Leadpages (US), Inc.
| | |
|---|---|
| Legal entity and address | Leadpages (US), Inc., 520-1515 Douglas Street, Victoria BC V8W 2G4 |
| What it does for us | Hosts `chemcalpro.com`, its pages and its enquiry and early-access forms |
| Categories handled | The first name, last name, email address and state a visitor enters into an enquiry form; visitor browsing and interaction data collected by the platform's own script and browser storage |
| Role | Processor for the enquiry data ChemCal Pro collects, where ChemCal Pro is the controller. Not a subprocessor, because it does not process data held in a customer's account |
| Processing location | Provider-operated infrastructure. Account-specific processing locations are not specified in this registry |
| Provider documentation | Leadpages Terms · Leadpages Privacy |
| Note that matters | Optional visitor-identification and identity-resolution sharing are disabled on ChemCal Pro's marketing website. Ordinary platform scripts and browser storage remain as described in the Privacy Notice. ChemCal Pro does not sell personal information for money |
5.5 GoDaddy — domain registrar and authoritative DNS
| | |
|---|---|
| Legal entity | GoDaddy group. The service-specific contracting entity is identified in the applicable domain-registration or DNS agreement |
| What it does for us | Domain registration and authoritative DNS for `chemcalpro.com` and its subdomains |
| Categories handled | ChemCal Pro's own registrant and account details, and DNS query data handled in the ordinary course of resolving names. It is not sent, and does not hold, tenant application data from customer accounts |
| Role | Independent controller for its own account and domain-registration purposes; any processor role depends on the particular customer-directed service and applicable agreement. Not a subprocessor of tenant application data in the arrangement described here |
| Processing location | Account-specific processing locations are not specified in this registry |
| Provider documentation | GoDaddy Global Privacy Notice |
| Note | ChemCal Pro does not claim that a registrar or DNS provider processes no personal information at all. The distinction drawn here is between registrant and query-level processing on one hand, and customer-directed application data on the other |
5.6 When a Section 5 provider becomes a subprocessor
A provider listed in this Section 5 is treated as a subprocessor for the purposes of the Data Processing Addendum, and this registry is updated accordingly, where and to the extent it actually processes Customer Personal Data on a customer's instructions — for example where ChemCal Pro acts on a documented Customer instruction through that channel, or where customer-directed account content is transferred into it.
The test is the data, not the interaction. A customer's administrator emailing support, or booking a call, does not by itself convert a business-correspondence provider into a subprocessor. Equally, ChemCal Pro does not treat all business correspondence as categorically outside customer-directed processing, and will list a provider in Section 4 where the facts warrant it.
5.7 Internal document-review providers (identified by category)
| | |
|---|---|
| What they do for us | Hosting and document analysis for manufacturer reference material that ChemCal Pro selects, such as product labels and safety data sheets. ChemCal Pro staff review the results before any product information is used |
| Categories handled | Manufacturer documents, which can include manufacturer contact details; draft reviews; and administrative and technical information |
| Role | Processors for ChemCal Pro's own review material in its current use. If customer-directed personal data is processed through these providers, Section 5.6 applies |
| Processing location | Account-specific processing locations are not specified in this registry |
---
6. At a glance
| Provider | Function | Section | Role |
|---|---|---|---|
| Supabase Pte. Ltd. | Database, authentication, file storage and backups | 4.1 | Subprocessor |
| Vercel Inc. | Application hosting and delivery | 4.2 | Subprocessor |
| Plus Five Five, Inc. (Resend) | Transactional and authentication email | 4.3 | Subprocessor |
| Functional Software, Inc. (Sentry) | Error and performance monitoring, error-triggered replay | 4.4 | Subprocessor |
| Cloudflare, Inc. | Backup storage | 4.5 | Subprocessor |
| GitHub, Inc. | Backup processing and source-code hosting | 4.6 | Subprocessor |
| Stripe | Payments, subscriptions, billing portal | 5.1 | Dual role |
| Google Workspace | Business email, calendar and meetings; sign-in provider | 5.2 | ChemCal Pro's own data; independent for sign-in |
| HubSpot, Inc. | Relationship records and meeting scheduling | 5.3 | ChemCal Pro's own data |
| Leadpages (US), Inc. | Marketing website and enquiry forms | 5.4 | ChemCal Pro's own data |
| GoDaddy | Domain registration and DNS | 5.5 | ChemCal Pro's own data |
| Internal document-review providers | Hosting and document analysis for ChemCal Pro's internal review | 5.7 | ChemCal Pro's own data |
---
7. Changes to this registry
7.1 ChemCal Pro will publish an updated, dated version of this registry before a new subprocessor begins processing Customer Personal Data.
7.2 For a material new or replacement subprocessor, ChemCal Pro will give at least 30 days' notice by publishing the updated registry and notifying the account contact of record. No subscription list is required to receive that notice.
7.3 A customer may object during the notice period on reasonable, documented data-protection grounds. Section 7 of the Data Processing Addendum governs the objection process and the remedy.
7.4 Where an emergency replacement is reasonably necessary to protect the Service or to comply with law, ChemCal Pro will act as promptly as it can and will notify affected customers as soon as practicable.
7.5 The notice and objection process in Sections 7.1 to 7.4 applies to the Section 4 list. A change to Section 5 is published in the same dated registry but does not carry a subprocessor objection right, because those providers do not process Customer Personal Data — unless Section 5.6 applies, in which case the provider moves to Section 4 and the process applies.
---
8. Information about provider arrangements
Customers may request information reasonably necessary to understand the processing of their Customer Personal Data, including the relevant provider arrangements and processing locations, through the contact below and the Data Processing Addendum's information process. ChemCal Pro will provide information it can substantiate, subject to appropriate confidentiality and security protections.
The providers' public documentation does not itself establish a specific region, retention setting, account configuration or executed data-transfer instrument for ChemCal Pro. No exclusive data residency or independently audited compliance status is promised by this registry.
---
9. Contact
Questions about this registry: `support@chemcalpro.com`, subject line Subprocessor Question.
---
10. Version history
| Version | Date | Change |
|---|---|---|
| 2.0 | September 1, 2026 | Consolidated registry of current application, backup, communication, billing, marketing and infrastructure providers. Separates customer-data subprocessors from providers used for ChemCal Pro's own purposes, states the applicable notice process, and describes processing-location limitations. This version applies through the publication and notice process described above |
| 2.1 | October 5, 2026 | Adds Section 5.7, identifying by category the providers ChemCal Pro uses for its own internal review of manufacturer reference material, and shortens provider descriptions without changing any provider, role, data category or Section 4 scope. Section 5.6 is unchanged |