All documents
Subprocessor and Vendor List
The configuration-derived services that may process production personal data for Desk Dollars.
- Version:
- 2026-08-14-v1
- Effective August 15, 2026
- Effective August 15, 2026
This is the controlling English (United States) version. The en-US text controls if a convenience translation differs.
1. How this list works
This page is generated from deployment configuration and names a vendor only when its service is enabled or its verified facts are supplied. Each entry identifies legal name, service, data, purpose, locations when known, privacy or DPA URL, and affected users.
PostgreSQL and Umami are software operated by Andrew Hall/Desk Dollars, not external processors merely because the software has a name. Their configured hosting or analytics infrastructure provider is listed separately when it processes production personal data. GitHub, Arcane, build tools, and local administrator tools are not listed unless they receive production personal data.
2. Unresolved facts fail closed
Production hosting, email delivery, and data-region facts are required for public signup. Optional backup, monitoring/error, support, proxy, or external analytics infrastructure is listed when configured and must have complete public facts before it processes production data. An unresolved required or enabled-service fact keeps public signup or the affected feature or region disabled; Desk Dollars does not invent a vendor or processing location.
3. Vendor changes and objections
The inventory is reviewed when configuration changes and shows an update date. For notice of a material subprocessor change or to make a reasoned DPA objection, email [email protected]. Vendor contracts and settings must support the Privacy Policy and DPA before production personal data is sent.
4. Payment and international roles
Sold through Link, LLC/Stripe performs independent merchant-of-record and controller functions for Managed Payments when enabled. A listed processor location does not itself activate an international transfer mechanism. Required representatives, annexes, or safeguards must be completed before affected regional signup is enabled. The en-US text controls.
Configured production inventory
Inventory updated August 15, 2026
| Vendor / service | Data and purpose | Location and affected users | Privacy / DPA |
|---|---|---|---|
| Andrew Hall / Desk DollarsOperatorDesk Dollars-operated PostgreSQL database software |
Store the application's structured production records | Florida, United States teachers, students, school contacts | Privacy / DPA |
| Andrew Hall / Desk DollarsProcessorProduction application and database infrastructure |
Run the production service and its PostgreSQL storage | Florida, United States teachers, students, school contacts | Privacy / DPA |
| GomailifyProcessorTransactional email delivery |
Send verification, recovery, service, and configured notification email | Florida, United States teachers, support contacts | Privacy / DPA |
| Sold through Link, LLC and Stripe group entitiesIndependent controllerStripe Managed Payments, Link checkout, billing, tax, fraud, and transaction support |
Act as merchant of record and operate the annual subscription transaction | United States and other locations described by Stripe's service-provider disclosures subscribing teachers, billing contacts | Privacy / DPAhttps://stripe.com/legal/service-providers |
| Cloudflare, Inc. and applicable Cloudflare affiliateProcessorTurnstile anti-abuse challenge |
Block automated abuse on configured public account forms | Cloudflare's global network and disclosed subprocessor locations public account-form visitors, teachers | Privacy / DPAhttps://www.cloudflare.com/cloudflare-customer-dpa/ |
| Andrew Hall / Desk DollarsOperatorDesk Dollars-operated Umami analytics software |
Understand aggregate product use and reliability without advertising profiles | Florida, United States site visitors, teachers, students | Privacy / DPA |
All required public vendor facts are present in this configuration.