Last updated: 19 March 2026
Scope: This list describes third parties that process personal data on our behalf in connection with SME Procure, based on our current codebase. Add your production frontend hosting provider (e.g. Vercel, AWS, Cloudflare) here if not already covered-Convex hosts backend logic and data on their platform.
When we use another company to provide part of the Service (for example cloud database or email delivery), that company may process personal data on our instructions. These organisations are often called “subprocessors” or “processors.”
You do not usually need to publish an infinitely nested list of every company your vendors use (for example, every subprocessor of Convex or Google). Standard practice is to:
Customer DPAs or enterprise terms may require notification before new subprocessors are added; this page is updated when our stack changes.
The following subprocessors are used in the operation of the Service by SME PROCURE LTD. Links go to each provider’s privacy information.
| Subprocessor | Purpose | Privacy |
|---|---|---|
| Clerk (Clerk, Inc.) | Authentication, sign-in, session and account management for the application. | clerk.com/legal/privacy |
| Convex (Convex, Inc.) | Backend platform: database, server functions, file storage, and real-time sync for SME Procure data. | www.convex.dev/legal/privacy |
| Google (Google Maps Platform) | Places autocomplete, place details, and geocoding when users search for or set locations (via server API routes and client maps). | policies.google.com/privacy |
| OpenAI | Embeddings and related AI processing used in backend features (e.g. document indexing and retrieval). | openai.com/policies/privacy-policy |
| Pinecone (Pinecone Systems, Inc.) | Vector database for search and retrieval over indexed document content. | www.pinecone.io/legal/privacy |
| Resend (Resend, Inc.) | Transactional email delivery integrated with our backend (Convex Resend component). | resend.com/legal/privacy-policy |
Client-side libraries (for example TanStack Query for data fetching, or UI components) run in the user’s browser and are not listed here as separate “subprocessors” in the same sense as hosted services that store or process personal data on our behalf-unless a library sends personal data to that vendor’s servers in a way that qualifies as processing for us (we do not use third-party analytics in this list by default; add tools such as Posthog or Sentry here if you enable them).
We will update this page when we add or remove subprocessors material to the Service. Material changes may also be reflected in our Privacy Policy.