Legal
Subprocessors
Last updated 7 September 2026
DeckHand uses the service providers below. Each one is here with what it does and what it can actually see — including the AI model, which reads the messages and photographs your customers send.
| Service | What it does | What it can see |
|---|---|---|
| Supabase | Database, authentication and file storage | Everything: accounts, messages, drafts, business facts, and photographs |
| OpenAI | Classifying inbound messages, drafting replies, and staff-reviewed support assistance when enabled | Inbound message text and photographs with relevant business facts; for support assistance, the submitted DeckHand request and approved support facts, without blanket access to homeowner conversations or photos |
| Railway | Runs the background worker that receives and sends messages | Everything in transit through the pipeline |
| Vercel | Serves the website and the application | Account sessions and anything shown on a page you open |
| Stripe | Subscription billing | Billing contact and payment details. We never receive card numbers |
| Twilio | Supporting carrier text messages for existing legacy configurations | For those existing configurations, phone numbers and the content of text messages |
| Resend | Sending and receiving email | Email addresses and the content of emails |
| Expo and platform push services (Apple / Google) | Delivering optional app notifications through Expo to APNs or FCM | Push token, generic notification text, event type and opaque destination identifiers; no private message body, customer name, address or photograph in the notification payload |
| Cloudflare | DNS, and the bot check in front of the website widget | IP address and browser signals of a visitor submitting the form |
Processing locations and provider-held copies depend on each service and its configuration. This list does not promise that all processing is U.S.-only. Provider policies and contractual settings are reviewed before enabling a new data flow.
Changes
We will update this page before a new subprocessor starts handling customer data. If you want to be told when it changes, write to patcad@caltanventures.com.