The canonical register of third parties that process personal information to help KoalaFix provide and secure the Service, including purpose, data involved, location and change history.
| Provider and contracting entity | Purpose | Data involved | Primary location / region |
|---|---|---|---|
| Supabase, Inc. | Authentication, PostgreSQL database, storage, vector retrieval and Edge Functions | Account, workspace, conversation, diagnostic, Microsoft connection, usage and operational data | Sydney, Australia project; authorised support/subprocessors may operate elsewhere |
| Amazon Web Services, Inc. and applicable Australian affiliate | KoalaFix relay/application infrastructure, logging, container registry, secrets/configuration and software download delivery | Service requests, operational logs, identifiers; installer delivery metadata | Sydney, Australia for primary relay infrastructure; global edge locations for CloudFront |
| Microsoft Corporation: Azure OpenAI Service / Microsoft Foundry | Customer-facing AI chat inference and content-safety processing | Prompts, relevant conversation and diagnostic context, generated responses | Global — processing may occur in Microsoft Azure regions outside Australia, depending on deployment configuration |
| OpenAI OpCo, LLC | Query embeddings for knowledge retrieval; not fallback chat | Search-query text and embedding request metadata | United States |
| Microsoft Corporation: Microsoft 365 and Graph | User-authorised access to and actions in the Customer's Microsoft 365 environment; tenant consent and identity | Microsoft identity, tenant and feature-specific Microsoft 365 data | Customer-selected Microsoft 365 geography, with Microsoft's authorised global operations |
| Vercel Inc. | Hosting and delivery of the customer administration dashboard at app.koalafix.com | Dashboard requests, session/account context and data rendered or submitted through the dashboard | United States and global network |
| Stripe group, including Stripe Payments Australia Pty Ltd where applicable | Checkout, subscription and seat-quantity billing, discount administration, invoices, tax, payment processing and failed-payment recovery | Billing contact, Customer, workspace and subscription identifiers, purchased-seat quantity, discount, invoice, payment-status and transaction data | Australia, United States and other Stripe locations |
| Sendinblue SAS (Brevo) | Transactional email, invitations, installation, billing and other service email, and permitted marketing | Name, email, organisation, message and delivery events | European Union |
| Functional Software, Inc. (Sentry) | Scrubbed crash reporting, reliability monitoring and operational alerting | Error, device/app context, pseudonymous identifiers and scrubbed diagnostic fields | United States (Sentry's standard hosting region) |
| Cloudflare, Inc. | Website hosting, content delivery, security and Zaraz tag management; may proxy public forms | IP, browser/request metadata, public website events and form traffic | Global edge network |
| Plausible Analytics OÜ | Website analytics | Page, referral, device/browser and configured event data | European Union |
Microsoft 365 itself operates under the Customer's own Microsoft agreement; KoalaFix's access occurs through the Customer's delegated consent. It is listed here for transparency.
KoalaFix routes internal operational alerts through Microsoft Teams/Power Automate. These alerts are configured not to carry Customer Personal Data. If that changes, the relevant provider will be added to the register above with notice under section E.
Meta Platforms, Inc. is an advertising and measurement recipient, not a core Service Data subprocessor. If Meta Pixel or Conversions API is enabled, Meta can receive website event and device/browser information and handles it under its own terms and privacy policy. KoalaFix must not send KoalaFix account content, conversation content or Microsoft 365 data to Meta.
The Privacy Policy explains the data and visitor choices. Optional advertising events must remain disabled until the on-page control suppresses both browser and server-side events.
These commitments do not mean no provider processes or temporarily retains data for service delivery, security or abuse monitoring. The provider contract and configured service features control those details.
For a new or replacement Subprocessor that will materially process Customer Personal Data, KoalaFix gives Business Customer administrators at least 30 days' advance notice by email and updates this page.
If an urgent security, legal or service-continuity event makes advance notice impracticable, KoalaFix may make the change sooner, notify administrators promptly and explain the reason.
A Business Customer may object during the notice period on reasonable data-protection grounds by emailing support@koalafix.com. The process and available remedy are in the DPA.
Questions and objections: support@koalafix.com