Sub-processors
This page lists the third parties that TrueAgent Pty Ltd (ACN 636 626 956, ABN 70 636 626 956), trading as Snap Job Reports, engages to host, operate, monitor and support the Snap Job Reports Service (each, a Sub-processor). It is referenced by clause 14 of our Terms of Service and clause 5.1 of our Privacy Policy.
1How we engage Sub-processors
We engage Sub-processors only where they are necessary to deliver, secure or support the Service. Each Sub-processor is bound by written terms that require it to:
- process personal information only on our documented instructions and for the purpose for which we engaged it;
- implement appropriate technical and organisational security measures, having regard to the nature of the data;
- maintain confidentiality;
- comply with the Australian Privacy Principles or provide substantially equivalent protections;
- not use Customer Data (or any derivative identifiable to a customer or its Authorised Users) to train their own machine-learning or artificial-intelligence models (and AI providers only under terms that do not allow training on it); and
- cooperate with our security-incident, data-subject-rights and audit processes.
We remain accountable to our customers for the acts and omissions of our Sub-processors in respect of personal information they process on our behalf.
2Current Sub-processors
The following Sub-processors are engaged as at the “Last updated” date above. Connected Platforms (currently ServiceM8) are listed for transparency; the customer authorises and controls those integrations directly and the relevant platform’s own terms and privacy policy govern its handling of the customer’s data.
2.1 Infrastructure and hosting
Provide the underlying compute, database and storage on which the Service runs and on which Customer Data resides.
| Sub-processor | Purpose | Data categories | Processing region |
|---|---|---|---|
| Supabase supabase.com | Primary database (Postgres), authentication, file storage, realtime services and secret vault. | Account & identity data, Customer Data (photographs, schematics, signatures, field notes, voice-note recordings and transcripts, generated PDFs), Connected Platform tokens (stored as vault secret IDs). | Sydney, Australia (ap-southeast-2). |
| Vercel vercel.com | Hosting for the marketing website, administrator portal and progressive web application; serverless compute for API route handlers, OAuth callbacks, beta-interest and support form handling, voice requests, and the scheduled jobs that move photos and PDFs. Processes essentially all personal information in transit as the Service runs. | HTTP request and response data (including form submissions and login flows), authentication callbacks, photo and PDF payloads in transit, server logs (which can currently include voice-note transcripts and AI form-filling prompts and results). | Global edge network; primary serverless compute region is set in our hosting configuration and is presently outside Australia. We treat all Vercel processing as an overseas disclosure. |
| Railway railway.com | Long-running worker that renders PDF reports (Node.js with Puppeteer and Sharp). Fetches job photographs, schematics and report/job data (which can include client and site details and narrative) to render report PDFs, then writes them back to storage. | A meaningful slice of Customer Data transiently in memory during PDF render (photographs, schematics, site addresses, signatures, defect notes and report narrative); access tokens for Supabase storage; output PDFs written back to Supabase storage. | Singapore (Southeast Asia). |
2.2 AI services
Power the optional voice features in the field app, which turn speech into text and suggest form-field values. A technician reviews every suggestion. These providers must not use Customer Data to train their models.
| Sub-processor | Purpose | Data categories | Processing region |
|---|---|---|---|
| OpenAI openai.com | Speech-to-text for voice notes in the field app, both live transcription streamed from the technician's device and transcription of uploaded recordings. Only runs when a technician uses voice capture. | Voice-note audio (the technician's voice and any other voices picked up) and the resulting transcripts. | United States. |
| OpenRouter openrouter.ai | Routes requests to the AI model that suggests form-field values from a voice-note transcript. The model currently used is provided by OpenAI, which also processes these requests. | Voice-note transcripts, inspection context (such as asset type and component names), form-field lists and the suggested field values. | United States. |
2.3 Observability, analytics and security monitoring
Receive operational telemetry from the Service for the purposes of monitoring availability, diagnosing errors, understanding usage patterns and investigating incidents.
| Sub-processor | Purpose | Data categories | Processing region |
|---|---|---|---|
| PostHog posthog.com | Product analytics and error monitoring for the administrator portal, the web field app and the mobile app (including app crash reports), and session replay for the administrator portal and the web field app. | Internal account identifiers (not name or email), IP addresses and approximate location derived from them, device details, page and screen views, in-app events, error stack traces, browser console messages, and session-replay recordings. Text typed into input fields is masked and some photo views are hidden, but other on-screen content such as job details, client names and site addresses can appear in replays. | United States. |
| Grafana Cloud grafana.com/products/cloud | Aggregation of application logs (Loki) and metrics (Mimir) for operational monitoring, alerting and incident response. | Server logs (request IDs, tenant IDs, error messages) and service-health metrics. Known credentials are redacted before transmission. Logs from the voice features can currently include voice-note transcripts and AI form-filling prompts and results, which may contain job details. | Australia. |
2.4 Communications
Used to deliver transactional and operational messages, and to support internal business operations.
| Sub-processor | Purpose | Data categories | Processing region |
|---|---|---|---|
| Resend resend.com | Transactional email delivery for field-technician sign-in codes, report-delivery emails carrying the report PDF itself, billing notifications and security alerts. | Recipient and sender email addresses, subject lines and bodies of transactional emails, and report PDF attachments (which may contain site photographs potentially showing individuals, site addresses, signatures and defect notes) where the customer has elected email delivery. | United States (primary). Suppression lists and message logs are retained by Resend in accordance with its data-processing terms. |
| Google (Workspace and Chat webhooks) workspace.google.com | Internal business email and document collaboration; receipt of beta-interest and support-form submissions as Google Chat messages (our working record of those enquiries); and receipt of operational alerts from monitoring (e.g. new-account sign-ups, PDF render failures, queue-depth alerts). | Beta-interest and support-form submissions (name, work email, company, subject and free-text support messages); internal correspondence; new-account sign-up alerts (business name and business contact details); operational alert payloads that can incidentally include a customer or site name from an error context. | United States and Australia. |
| Expo (with Apple Push Notification service and Google Firebase Cloud Messaging) expo.dev | Delivers push notifications to our iOS and Android mobile app, for example when a job is assigned or a report is approved. Expo passes each notification to Apple or Google for delivery to the device. | Device push tokens and notification text, which can include a job number and site address. | United States. |
2.5 Connected Platforms (customer-authorised)
Third-party platforms that customers authorise the Service to connect to. We act as a recipient or sender of data on the customer's behalf; the platform is independently the customer's service provider.
| Sub-processor | Purpose | Data categories | Processing region |
|---|---|---|---|
| ServiceM8 www.servicem8.com | Primary integration platform. With the customer's authorisation, we read job, staff, checklist and photo data, and write generated PDF reports back to job attachments. | Jobs, staff identities, attachments, checklists, materials and similar operational data the customer has authorised us to access. | As determined by ServiceM8 (Australia / global). |
2.6 Planned Sub-processors
These are not engaged yet. We will add each one to the tables above, and give notice under the callout at the top of this page, before it receives any personal information:
- a payment provider, to take card payments when paid billing starts (card details will be held by that provider, not by us); and
- an AI provider for AI report writing, if and when that feature launches.
3Objecting to a new Sub-processor
Any customer may object to a proposed new Sub-processor within the 30-day notice period by emailing support@snapjobreports.com with the subject “Sub-processor objection” and a reasonable explanation of the objection. We will work with the customer in good faith to address the objection (for example, by proposing an alternative Sub-processor or workaround). If we cannot reasonably address it and we still proceed with the change, the affected customer may close its account or end the affected Plan by written notice, and we will refund prepaid Fees for the unused portion of the term and any unused Top-up Pack Reports.
4Change log
Material changes to this page (new Sub-processors, removals, or changes in processing region) are recorded below.
| Date | Change |
|---|---|
| 17 September 2026 | Updated the company details: TrueAgent Pty Ltd now operates Snap Job Reports in its own right, not as trustee of a trust. Added providers already used by the Service that were missing from this list: OpenAI and OpenRouter (voice features) and Expo with Apple and Google (mobile push notifications). Corrected the PostHog region to the United States and described what session replays can show. Removed the European Union failover statement for Grafana Cloud and disclosed that logs can include voice transcripts. Added voice-note data to Supabase and sign-up alerts to Google. Extended change notices and objection rights to every account, including free Plans and trials. Listed planned Sub-processors. |
| 25 June 2026 | Aligned processing regions and data categories with the revised Privacy Policy: Railway region corrected to Singapore; PostHog region corrected to the European Union; Resend purpose and data categories clarified to reflect report-PDF content; Google (Chat) entry updated to reflect that it receives beta-interest and support-form submissions (enquiry/contact and support free-text); Vercel processing described as an overseas disclosure. |
| 20 May 2026 | Initial publication of the Sub-processor list. |
5Contact
Questions about this list, or to subscribe to change notices, email support@snapjobreports.com.