A sub-processor is a third-party service provider that processes personal data on Comiine's behalf so that we can run the Service. This list supports our Privacy Policy and our Data Processing Agreement.
Each provider below is engaged under a written contract that requires it to protect personal data and to process it only on our instructions. Transfers of personal data outside Botswana are governed by the Data Protection Act, 2024 (Act No. 18 of 2024), and are described honestly in the "Where the data sits" section below.
This list was prepared in-house and has not yet been reviewed by a legal practitioner admitted in Botswana.
Notice of changes
We give customers 30 days' prior notice before we add or replace a sub-processor. We do that by updating this page, and by direct notice to the customer's nominated contact. During that period a customer may object on reasonable data protection grounds, and we will work with the customer in good faith to resolve the objection.
Current sub-processors
| Provider | What it does for us | Personal data it handles | Where it processes |
|---|---|---|---|
| Supabase | Primary database, authentication, file storage, and the synchronisation functions. It also composes our account emails and hands them to Resend to deliver | Account and identity data, and all Customer Data synchronised to the server, including workforce identifiers, photographs and digital signatures | United States, Amazon Web Services region us-east-1 |
| Resend | Delivery of our account emails: the sign-in link, the team invitation, the email-address confirmation and the password reset. Nothing else is sent by email | The recipient's email address, the content of that message, and delivery records such as whether the receiving mail server accepted it or bounced it | United States. Resend routes sending from a region you choose, but it stores message content, delivery logs and account records in the United States regardless of that choice |
| Sentry | Application error and crash monitoring | Device and technical data, app version, stack traces, a pseudonymous user identifier, and anything incidentally captured in error context | Outside Botswana, on Sentry's cloud infrastructure |
| Vercel | Hosting and delivery of our web app and our website | Web request and technical data, such as IP address and request logs. No core Customer Data is stored here | United States and Vercel's global edge network |
| Expo (EAS) | Mobile app build pipeline and over-the-air app updates | Device and technical data, and update check metadata | United States |
Our emails do not report back. The four account emails carry no tracking pixel, no remote images, no web fonts and no scripts — nothing in them is fetched from a server when the message is opened. So no provider learns when, where or whether you read one, and none of them can see your IP address from opening it. This is enforced in our build, not just intended: a check fails if any of those messages ever loads anything from the network.
Sentry receives nothing unless you switch crash reporting on. Crash reporting is off by default. When it is on, our configuration removes personal data before anything is sent: the default personal-data flag is off, the user is a pseudonymous identifier with no email address, screenshots and view hierarchy capture are off, and our filters mask email addresses and tokens and drop request headers and query strings.
Push notifications are not enabled. Expo builds and updates the app for us. Push message delivery is not switched on in the production app, so no push token is sent to a delivery service today. If that changes, we will update this list first.
Correction, recorded openly (2 September 2026). Until this date this list said, in bold, "We use no separate email provider. Transactional email is sent through Supabase's built-in email service, which is why there is no separate email row above." That was true when it was written and stopped being true on 2 September 2026, when we moved our account emails onto our own sender — Resend, sending from no-reply@mail.comiine.com. We made the change to stop Supabase's shared development sender rate-limiting our invitations and putting another company's name in front of the people we invite.
The Notice of changes section above promises 30 days' prior notice before we add or replace a sub-processor, and this list was updated on the day of the change rather than 30 days before it. We are recording that plainly instead of quietly adding the row. Anyone using Comiine when this changed may object on reasonable data protection grounds, and we will work with them in good faith; the contact address is at the foot of this page. The same paragraph is why the previous version of this list carried its own correction about product analytics — the rule this document keeps breaking is its own, and saying so is the only remedy that does not compound it.
Where the data sits, and what we rely on
Our servers are not in Botswana. Our database, authentication and file storage run on Supabase in the United States. Our email delivery, error monitoring, web hosting, and app build and update services also process limited data outside Botswana.
Botswana designated a list of countries as offering adequate protection in the Data Protection (Transfer of Personal Data) Order, 2022, issued on 29 July 2022. It lists roughly forty five countries, including those subject to the EU GDPR, and in Africa it lists South Africa and Kenya.
The United States is not on that list. We therefore do not claim an adequacy basis for our United States hosting. We rely on the data protection terms and contractual safeguards we hold with each provider, on telling every customer organisation exactly where its data is held, and on the security measures described in the Privacy Policy and in Annex 2 of the Data Processing Agreement.
We are seeking confirmation from a legal practitioner admitted in Botswana on the correct transfer basis, and on whether the Act requires a copy of personal data to be kept inside Botswana. We do not keep a copy inside Botswana today, and we do not claim that we do. Moving hosting to a region inside Africa is on our roadmap. We will update this page and tell customers when the position changes.
Product analytics: what is true
Comiine collects first-party, cookieless product usage events. They exist and they ship in the product today. They record the name of a core action, a timestamp, the organisation, a pseudonymous user identifier, the platform, the app version, and typed non-identifying properties only. Free text is structurally excluded.
Those events are stored in our own Supabase project, in a table we control. They are never sold, never used for advertising, and never shared with an advertising or analytics company. No third-party analytics or tracking service is used, and no sub-processor was added for this. That is why no row above changed when the feature shipped.
If we ever introduce analytics that involves a third party, we will disclose it in the Privacy Policy and add it to the table above before it ships.
Correction, recorded openly. An earlier version of this list said the product contained no product-analytics collection of any kind. That was true when it was written and became false the next day, when first-party cookieless analytics shipped on 17 August 2026. The Privacy Policy and the Retention Policy were updated at the time and this list was not, so for twelve days it asserted a negative the product disproved. It is corrected here rather than quietly deleted, because the paragraph broke the rule it states for itself.
Other points
- Where a provider also acts as a controller for its own limited purposes, such as billing or the security of its own platform, that processing is governed by the provider's own terms.
- We do not use third-party advertising or tracking services anywhere in the product or on our website.
Contact
Questions about this list: privacy@comiine.com. Millyjoy & Co (Proprietary) Limited trading as Comiine, Plot 7414, Mogoditshane, Botswana. Company registration BW00009256082.