Last updated: 2026-09-12
This list distinguishes providers acting on Jannie’s behalf from independent controllers. Exact data depends on configuration and must be limited to what each provider needs.
Subprocessors
| Provider | Function | Expected data | Required restrictions |
|---|---|---|---|
| Cloudflare, Inc. | Static frontend delivery, DNS/CDN, network security | IP address, request metadata, public site assets, security events | Do not cache authenticated or sensitive API responses; verify log and retention settings |
| Railway Corp. | Backend application hosting | API requests, operational metadata, application logs, encrypted connections to other services | Logs must redact SSN/TIN, bank data, tokens, exact GPS, photo paths, and NACHA content |
| Supabase, Inc. | Postgres database, authentication, private storage | Account, Customer, workforce, attendance, GPS, evidence, sensitive profile and banking data | RLS plus backend tenant enforcement; private storage; encryption/field protection; audited privileged access |
| OpenAI, L.L.C. | Limited AI response generation | Approved prompts, names or internal codes when necessary, generic location labels, limited operational summaries | Never send SSN/TIN, bank/routing data, date of birth, photographs, exact coordinates, NACHA files, credentials, or tax forms; training opt-in disabled |
| Resend, Inc. | Transactional and B2B marketing email | Recipient name/email, organization, message content, delivery and opt-out events | Do not include SSN, bank data, precise location, evidence, credentials, or NACHA content in email |
Independent controller: Microsoft Clarity
Microsoft Corporation provides attendance diagnostics only on production clock-in/out pages, including Spanish routes. It receives masked interaction/replay data where available, technical/browser metadata, connection IP/approximate location, a client-hashed contractor UUID, a short contractor reference, and fixed technical markers. Strict masking and denied advertising/analytics cookie storage apply.
Jannie and Microsoft are independent controllers under the Clarity Terms. Microsoft is not a processor, service provider, or subprocessor for this integration. Its own uses include Microsoft Advertising and product improvement under the Microsoft Privacy Statement. It may process data in the United States and elsewhere.
Playback retention is 30 days; labeled/favorited sessions and heatmap/click data are retained for 9 months. See the Privacy Policy and Cookie Notice for scope, access, choices, and limitations. Listing Microsoft here does not subject Clarity to the DPA’s subprocessor-only restrictions.
Changes
Jannie will update this list when a material subprocessor is added or replaced and will provide the notice required by the applicable Customer agreement or DPA.
Questions or objections: contact@jannie.app