The following subprocessors are engaged in the delivery of the Service to all Customers.
| Subprocessor | Processing performed | Location |
|---|---|---|
| Supabase | Primary database, authentication and file storage for Customer Data, and the provider’s own point-in-time database snapshots. | United States — Amazon Web Services, region us-east-1 |
| Cloudflare | Application and website delivery, DNS, serverless function execution, and inbound email routing. Also provides an aggregate page-performance measurement that sets no cookie and stores nothing on the visitor’s device. | United States entity; global delivery network |
| Stripe, Inc. | Subscription payment processing and, where enabled by the Customer, online invoice payment. Cardholder data is processed by Stripe and is not received by MIXEL INC. | United States |
| Resend | Transmission of outbound email sent by the Service on a Customer’s behalf, and receipt of inbound replies routed back to the originating workspace. | United States |
| Google LLC (Google Drive) | Storage of the encrypted off-site backup copies of Customer Data described on the Security page. Backups are encrypted by MIXEL INC before transfer; Google stores only ciphertext and holds no decryption key. This is MIXEL INC’s own storage and is separate from any Google account belonging to a Customer. | United States |
The following subprocessors receive personal information only where a Customer uses the associated feature.
| Subprocessor | Processing performed | Location |
|---|---|---|
| Anthropic PBC | Interpretation of material submitted by a user to an AI-assisted feature — receipt and document reading, catalogue matching, import column mapping and drafting assistance. Transmission occurs only on invocation of the feature and is limited to the item submitted. Under Anthropic’s commercial API terms, inputs and outputs are not used to train its models. | United States |
| Google LLC | Authentication, only where a user elects to sign in with Google; and, only where a user connects Google Calendar under Privacy Policy section 5, the receipt of that user’s KitSlate bookings as calendar events written to the Google calendar the user chose. Google processes those events under its own terms as the user’s calendar provider. MIXEL INC receives the user’s name, email address and profile picture, and accesses no other Google service. | United States |
No subprocessor listed on this page is authorised to process personal information for its own purposes, to disclose it to a further party except as necessary to deliver its service to MIXEL INC, or to use it for advertising. MIXEL INC does not sell personal information, does not share it for cross-context behavioural advertising, and does not disclose it to data brokers. No subprocessor is authorised to use Customer Data to train machine-learning models.
MIXEL INC maintains this page as the current record of its subprocessors and updates it before engaging a new subprocessor that processes personal information. Customers who wish to be notified of changes may register a contact address by writing to privacy@kitslate.app, and will receive notice of an intended addition or replacement in advance of engagement.
A Customer may object to a proposed subprocessor on reasonable data-protection grounds by writing to the same address. Where an objection cannot be resolved, the Customer may terminate the affected portion of the Service in accordance with Section 16 of the Terms & Conditions.
Questions regarding this register, or requests for further information about a listed subprocessor, may be directed to privacy@kitslate.app.
MIXEL INC
a New York corporation, doing business as KitSlate
State of New York, United States
privacy@kitslate.app · kitslate.app