Subprocessor Register

How to read this register

A subprocessor is a supplier that processes personal data on Warsha's behalf. Every one is listed here before it processes anything.

Each entry states its status. "In use" means it is processing data now. "Approved, not yet in use" means a governance decision has been taken and the integration has not been built — no data has reached it.

Adding a subprocessor, or moving one from approved to in use, is a material change to the Privacy Policy. You are told who, for what, and where, before it takes effect.

Supabase — in use

Purpose: the database, authentication, file storage and realtime messaging that the platform runs on.

Data: all personal data Warsha holds — accounts, bookings, messages, payments, addresses, identity documents and criminal-record certificates.

Location: managed cloud infrastructure. The region in force is recorded in the operational configuration.

Safeguards: access enforced in the database on every table; identity documents in private storage reached only through short-lived links; staff access logged.

Expo Application Services — in use, limited

Purpose: building and distributing the mobile applications.

Data: build artefacts and crash diagnostics where you have not turned diagnostics off. No account data, no bookings, no messages, no documents.

Over-the-air updates are configured but not enabled in this version, so no update channel is serving this application.

Google Cloud Vision — approved, not yet in use

Purpose: extracting the text printed on a worker's National ID so the worker does not have to type it.

Data, when in use: the identity document image, server-side only. Never called from a phone. Only extracted fields return to the device; the raw response is not retained.

Status: no document has been sent. Identity fields are entered by hand in this version.

Conditions of engagement: provider terms must prohibit using Warsha data to improve the provider's own models. Turning this on requires a new version of the OCR Usage Policy, the AI Usage Policy and the Privacy Policy, and renewed acceptance from affected workers.

Google Maps Platform — approved, not yet in use

Purpose: displaying a map, searching an address, and converting between an address and coordinates.

Data, when in use: the address text you search and the coordinates of the pin you are placing. Not a movement history — Warsha collects no background location.

Status: not integrated. Address search and device positioning report as unavailable, and manual pin placement is the working path. Warsha does not display a map that pretends to be live when no provider is configured.

Turning this on requires a new version of the Location Data Policy and the Privacy Policy, and renewed acceptance.

Payments

No payment gateway is engaged. Production payment processing is disabled in this version and no card data is processed by any supplier on Warsha's behalf.

Engaging a gateway will be a material change, will add an entry here, and will require renewed acceptance before any payment is processed through it.

Not used

Warsha uses no advertising network, no analytics supplier that identifies you, no data broker, no email marketing platform, and no supplier that receives identity documents other than as stated above.