1. Introduction
This document provides a comprehensive catalog of third-party services integrated with or used by the Smartta AI platform. We believe in transparency about our technology stack and data processing partnerships to help you make informed decisions about using our services.
We review providers at least yearly; those handling personal data must protect it under written terms.
Privacy and Data Protection
How we handle personal information shared with the services listed here is described in our Privacy Policy and Data Processing Agreement.
2. Essential Platform Services
Core Infrastructure & Authentication
Services that provide fundamental platform functionality and user authentication
Amazon Web Services (AWS)
- Purpose:
- Cloud infrastructure, data storage, computing resources
- Data Processed:
- All application data, user information, file storage
- Location:
- Sydney, Australia (ap-southeast-2)
- Privacy Policy:
- AWS Privacy Notice
- Provider certifications:
- ISO 27001, SOC 2, PCI DSS (held by AWS)
Auth0 by Okta
- Purpose:
- User authentication and identity management
- Data Processed:
- Email addresses, authentication tokens, login metadata
- Location:
- Australia and United States
- Privacy Policy:
- Auth0 Privacy Policy
Cloudflare
- Purpose:
- Bot check (Cloudflare Turnstile) on sign-in
- Data Processed:
- Signals from the visitor's browser used for the bot check, including IP address. No platform traffic is proxied through Cloudflare and no customer records are sent to it.
- Location:
- Global network
- Privacy Policy:
- Cloudflare Privacy Policy
- Provider compliance:
- GDPR compliant, EU-US Data Privacy Framework (as stated by Cloudflare)
Database & Data Management
Services for data storage, processing, and backup
Database and caching services are locally hosted on our own infrastructure - no third-party database sub-processors are used.
AI Services
Model providers used by the platform's AI features
Anthropic (Claude)
- Purpose:
- AI model processing for the platform's AI features
- Data Processed:
- Prompts sent by the platform's AI features, which may include customer workforce data
- Location:
- United States
- Privacy Policy:
- Anthropic Privacy Policy
OpenAI
- Purpose:
- AI model processing for the platform's AI features
- Data Processed:
- Prompts sent by the platform's AI features, which may include customer workforce data
- Location:
- United States
- Privacy Policy:
- OpenAI Privacy Policy
Google (Gemini)
- Purpose:
- AI model processing for the platform's AI features
- Data Processed:
- Prompts sent by the platform's AI features, which may include customer workforce data
- Location:
- United States
- Privacy Policy:
- Google Privacy Policy
3. Communication & Notification Services
SendGrid by Twilio
- Purpose:
- Transactional email delivery, notifications
- Data Processed:
- Email addresses, email content, delivery statistics
- Location:
- United States with global infrastructure
- Privacy Policy:
- Twilio Privacy Policy
- Provider compliance:
- GDPR, CCPA, PIPEDA compliant (as stated by Twilio)
Twilio SMS
- Purpose:
- SMS notifications and two-factor authentication
- Data Processed:
- Phone numbers, SMS content, delivery status
- Location:
- Global with Australian local numbers
- Privacy Policy:
- Twilio Privacy Policy
4. Analytics & Monitoring
Analytics and monitoring services are locally hosted on our own infrastructure - no third-party analytics sub-processors are used.
5. Payment & Billing
Stripe
- Purpose:
- Payment processing, subscription billing
- Data Processed:
- Payment information, billing addresses, transaction history
- Location:
- Global with Australian entity (Stripe Payments Australia)
- Privacy Policy:
- Stripe Privacy Policy
- Provider certification:
- PCI DSS Level 1 (held by Stripe)
Xero
- Purpose:
- Accounting and financial management integration
- Data Processed:
- Invoice data, payment records, financial transactions
- Location:
- Australia and New Zealand
- Privacy Policy:
- Xero Privacy Policy
- Integration:
- Connected via OAuth 2.0, authorised by the customer
6. Development & Deployment Tools
GitHub
- Purpose:
- Source code management, CI/CD pipelines
- Data Processed:
- Source code, development workflows, deployment logs
- Location:
- United States
- Privacy Policy:
- GitHub Privacy Statement
- Access:
- Limited to authorized development team members
Docker Hub
- Purpose:
- Container image registry and deployment
- Data Processed:
- Application container images, deployment metadata
- Location:
- United States
- Privacy Policy:
- Docker Privacy Policy
Security and Compliance Measures
- Provider review: We review providers at least yearly; those handling personal data must protect it under written terms.
- Incident Response: Established procedures for security incident management
7. Data Transfer and Processing
For third-party services located outside Australia:
- Before disclosing personal information to an overseas recipient, we take reasonable steps under APP 8 to ensure the recipient handles it consistently with the Australian Privacy Principles
- Where the GDPR applies, transfers rely on Standard Contractual Clauses or an adequacy decision, as set out in our Data Processing Agreement
- The countries where personal information may be disclosed are listed in our Privacy Policy
8. Your Rights and Controls
You have the following rights regarding data processed by third-party services:
- Access: Request information about data processed by third parties
- Rectification: Correct inaccurate data held by service providers
- Erasure: Request deletion of your data from third-party systems
- Portability: Obtain your data in a machine-readable format
- Objection: Object to processing by specific third-party services
To exercise these rights, contact us using the information in the Contact section below.
9. Updates and Changes
This catalog is updated when our third-party providers or integrations change. We will notify users of material changes that may affect data processing or privacy.
Version history is maintained to track all changes and ensure transparency in our service provider relationships.
Contact Information
For questions about third-party services or data processing:
- Privacy Team: privacy@smartplace.ai
- Security Team: security@smartplace.ai
- Legal Team: legal@smartplace.ai
- Data Protection Officer: dpo@smartplace.ai