Service Provider and Subprocessor Register

About This Register

ROVYN uses the providers below to operate, secure, support, and integrate TaskForceOne. A provider acts as a subprocessor where it processes Customer Personal Information within the scope of our Data Processing Addendum; it may instead support ROVYN's own activities for other processing. The listed categories describe information a provider may process for that function. Actual processing depends on service configuration and whether the relevant feature or integration is enabled.

Core Service Providers

• DigitalOcean — managed cloud database and related infrastructure; may process account, organisation, workforce, audit, and application data. Processing can occur in the selected hosting region and through support or security providers in the United States. See DigitalOcean's current subprocessor list.
• Cloudflare — R2 object storage and content delivery; may process uploaded documents, images, videos, message attachments, technical logs, and network information. Bucket placement depends on ROVYN's Cloudflare configuration, and Cloudflare operates a global network. See Cloudflare's R2 location information.
• Resend — service email and separately consented marketing email delivery; may process recipient names and email addresses, message content, provider and delivery identifiers, unsubscribe headers, delivery, bounce, complaint and suppression events, and technical metadata. Resend and its listed subprocessors are based in the United States, where email data may be processed. It may act within Customer-directed service processing or support ROVYN's own direct-marketing activity, depending on the message. See Resend's current subprocessor list.
• Stripe — subscriptions, invoices, payment processing, tax and fraud workflows; may process customer contact, billing, payment-token, transaction, and device information. ROVYN does not store complete payment-card numbers. Stripe operates globally, including in the United States, and publishes provider-specific countries in its current service-provider list.
• Google — Firebase push notifications, reCAPTCHA on public website forms, and favicon retrieval for domains in shared messenger links; may process device and notification tokens, notification payloads, application and delivery metadata, IP address, browser and device information, interaction signals, shared-link domain names, and request metadata through Google's global infrastructure. See Firebase privacy and security information and Google's Privacy Policy.
• Apple — iOS push-notification delivery; may process device tokens, notification payloads, and delivery metadata. See Apple's Privacy Policy.
• Sentry — error monitoring, diagnostics, and performance troubleshooting; may process IP address, device and browser details, error context, identifiers, and limited application data present in a diagnostic event. Processing depends on the configured storage region, with providers and support affiliates in the United States, Canada, and Europe. See Sentry's current subprocessor list.
• Mapbox — maps, address lookup, and location interfaces; may process map requests, IP address, device information, and location or address queries when those features are used. Mapbox identifies primary processing in the United States and global content delivery and support locations. See Mapbox's current subprocessor list.
• Discord — routing of website contact, support, or industry-partner enquiries to the TaskForceOne team; may process the contact details and message a person submits through those forms. Discord is based in the United States, where submitted information may be processed. See Discord's Privacy Policy.

Customer-Selected Integrations

• Xero — payroll integration; may receive or return employee identifiers, pay items, settings, timesheets, leave information, export results, and related payroll data when connected by a Customer. Xero and its current provider list include Australia, New Zealand, the United States, the United Kingdom, India, Singapore, Canada, and South Africa. See Xero's current subprocessor list.
• MYOB — payroll integration; may receive or return company-file identifiers and credentials, employee identifiers and details, payroll settings, pay and entitlement categories, timesheets, leave information, and export results when connected by a Customer. MYOB's Australian privacy policy identifies overseas recipients including in New Zealand, the Philippines, and the United States. See MYOB's Privacy Policy.

Processing Locations

We do not describe all Customer Data as exclusively stored or processed in Australia. Personal information is likely to be processed in the United States and may be processed in New Zealand through some integrations or provider routes.

Depending on the provider and support path, processing may also occur in countries including Canada, the United Kingdom, European Union countries, India, Malaysia, the Philippines, Singapore, Japan, and South Africa. The exact location depends on the enabled service, Customer-selected integration, configured storage region, and a provider's current infrastructure. The links above provide the most detailed current provider lists.

Changes and Objections

We may update this register as the service changes. Where a new provider will materially change how Customer Personal Information is processed, we will give affected Customers reasonable advance notice when practicable or required by contract or law. A Customer with a reasonable data-protection objection should contact us promptly so we can discuss available safeguards or alternatives.

Contact

Questions about a provider, processing location, or data category can be sent to [email protected].