Service Provider and Subprocessor List

Effective 25 August 2026 · Saywell is a product of PsycFin Pty Ltd (ABN 81 697 454 345), Australia

This is the current authoritative list referenced by the Data Processing Addendum and Privacy Policy. The entries describe providers that materially process personal information for Saywell. Providers that have not passed their adoption review are not listed as active. The limits stated under each provider are part of the approved data boundary.

Current providers

Anthropic, PBC

Purpose: AI-assisted draft and report generation through a commercial Anthropic Claude API.
Categories handled: Derived communication profiles, advisor voice material, authorised notes or correspondence, prior draft context and other content needed for generation. Stored names, email addresses and unnecessary advisor or firm identifiers are replaced with neutral placeholders before transmission. Full dates of birth, account identifiers and raw assessment answers are excluded. Incidental names or third-party details in free text may remain.
Processing location: United States.
Readable-content access: Yes. Anthropic can process readable prompt and output content. Commercial API content is not used to train general models by default. Unless the documented Zero Data Retention gate passes, prompts and outputs may be retained for approximately 30 days, with limited longer retention under Anthropic's terms.

Supabase, Inc.

Purpose: Database, authentication, file storage and managed backups.
Categories handled: Stored Saywell account, advisor, client, assessment, correspondence, draft, activity, security and request records. Stripe card numbers are not stored by PsycFin.
Processing location: United States. Exact project region is verified before publication.
Readable-content access: Yes. Supabase hosts readable stored data. Access is controlled through tenant isolation, role-based provider controls and PsycFin's sole-administrator access model.

Vercel, Inc.

Purpose: Application hosting and delivery.
Categories handled: Application requests and data in transit. Operational logs are designed to exclude personal information, prompts, outputs and client content.
Processing location: United States. Exact deployment region is verified before publication.
Readable-content access: Transit only by design. Vercel should not receive readable customer or client content in retained application logs.

Stripe, LLC and Stripe Payments Australia Pty Ltd where applicable

Purpose: Checkout, payment processing, subscriptions, invoices, tax and fraud prevention.
Categories handled: Advisor-firm billing identity, billing address, card brand, last four digits and expiry, Stripe customer and subscription identifiers, payment history, failed-payment reasons and fraud or dispute signals. Stripe handles full payment-card details directly.
Processing location: United States and Australia, with provider infrastructure and subprocessors as stated by Stripe.
Readable-content access: Billing data only. Stripe does not receive advisor-client content or product records. PsycFin never receives full card numbers.

Plus Five Five, Inc. (Resend)

Purpose: Transactional email, including assessment invitations, reports, reminders and service notices.
Categories handled: Recipient name and email address, message content, delivery status and bounce information. Assessment emails contain no tracking pixels or per-recipient tracked links.
Processing location: United States.
Readable-content access: Yes. Resend processes readable recipient and email content needed for delivery.

Cloudflare, Inc.

Purpose: DNS, domain and marketing-site delivery, waitlist processing and cookieless first-party web analytics.
Categories handled: Marketing-site and waitlist traffic, IP and device or request information processed by infrastructure, waitlist information in transit and aggregated cookieless site analytics. No logged-in product or assessment content.
Processing location: Global edge network; United States provider.
Readable-content access: Limited to marketing-site, waitlist and network traffic. Cloudflare does not receive advisor-client product content by design.

Functional Software, Inc. (Sentry)

Purpose: Technical error monitoring.
Categories handled: Technical error events, request identifiers and diagnostic context. Logging hygiene is designed to exclude personal information, prompts, outputs and client content.
Processing location: United States.
Readable-content access: No readable personal or client content by design. Any configuration change that expands collection requires privacy review.

Google LLC, including Google Tag Manager and Google advertising services

Purpose: Marketing-page advertising measurement, conversion reporting and remarketing while campaigns run.
Categories handled: Marketing-site visitor information only, such as page URL, IP-derived network information, browser or device details, referrer, campaign identifiers and the fact that a conversion event occurred. Form-field values, names, email addresses, information typed into Saywell forms, Enhanced Conversions and Customer Match are prohibited unless separately approved through privacy review.
Processing location: United States and Google's global infrastructure.
Readable-content access: Marketing-visitor event information only. Google never receives customer or client information held for advisor firms, product content, assessment content or form values. Google is outside the DPA subprocessor-notice process because it does not process Customer Personal Data.

Microsoft Corporation (Microsoft 365)

Purpose: Business email hosting for the hello@saywellhq.com channel.
Categories handled: Privacy requests, complaints, support and business correspondence, which may include personal information a requester or firm sends by email. No access to product database records.
Processing location: Microsoft 365 tenancy; region verified before publication.
Readable-content access: Yes, for email correspondence sent to or from PsycFin mailboxes.

Change and notice process

Before a new provider processes customer personal data, PsycFin updates this list and gives at least 30 days' email or recorded account notice referencing it. An objection during that period must state reasonable data-protection or regulatory grounds. The parties first try to resolve the concern, including by limiting the affected processing where practical. If it cannot be resolved, the customer may terminate the affected service before the new provider begins processing, using the agreement's existing refund mechanics.

An emergency replacement needed for security, service continuity or legal necessity may proceed on shorter notice, with notice as soon as reasonably practicable. Providers that do not process customer personal data are outside the DPA objection process. Enquiries: hello@saywellhq.com.