Sub-processors

Version: 2026-10-06 Last reviewed: 6 October 2026

Pevan & Sarah Pty. Ltd. (ABN 93 666 885 436) uses the providers below to operate its website and services. This disclosure accompanies our Privacy Policy.

The list includes service providers acting on our behalf and providers that may also handle information independently under their own privacy terms. We share information relevant to each provider's role. Provider names link to their websites for contact and further information.

Providers and Personal Information

Fly.io

  • Purpose: Hosting and operating the service
  • Personal information handled: Account, subscription, activity and technical information
  • Processing and storage locations: Australia for our core hosting; overseas support and operational processing, including the United States. Its provider list also identifies the United Kingdom and Germany.
  • Applicable processing basis: Providing the service; service security

Vercel

  • Purpose: Website hosting and delivery
  • Personal information handled: Account and technical information needed to provide website features
  • Processing and storage locations: Australia for our website server processing; global delivery and overseas operations, including the United States, as described in its data-processing terms
  • Applicable processing basis: Providing the service; service security

Amazon Web Services

  • Purpose: File delivery and backups
  • Personal information handled: Technical request information and backup copies of account and activity information
  • Processing and storage locations: Australia for our storage and backups; provider support may involve overseas processing under its data-protection terms
  • Applicable processing basis: Providing the service; service security

Stripe

  • Purpose: Payments and subscription billing
  • Personal information handled: Contact, billing and payment information
  • Processing and storage locations: International processing, including the United States, under its data-processing terms
  • Applicable processing basis: Providing subscriptions and payments; legal obligations

Mux

  • Purpose: Video delivery and viewing analytics
  • Personal information handled: Technical information, viewing activity and account identifiers
  • Processing and storage locations: United States and global video delivery locations, as described in its privacy information
  • Applicable processing basis: Providing video playback; improving service quality

Postmark

  • Purpose: Service emails
  • Personal information handled: Recipient details, message content and delivery information
  • Processing and storage locations: United States, as described in its hosting information
  • Applicable processing basis: Providing the service; service security; legal obligations where applicable

Flodesk

  • Purpose: Newsletters, signup reminders and subscription-related emails
  • Personal information handled: Contact details, relevant subscription information and email engagement
  • Processing and storage locations: United States and other countries where Flodesk and its providers operate, as described in its data-processing terms
  • Applicable processing basis: Consent for newsletter marketing; providing the service or responding to a signup for service communications

Sentry

  • Purpose: Identifying and resolving errors
  • Personal information handled: Error reports, technical information and relevant account identifiers
  • Processing and storage locations: United States and Germany are provider processing locations; international support and further processing are described in its transfer information
  • Applicable processing basis: Service security; improving service quality

Google Analytics

  • Purpose: Website analytics
  • Personal information handled: Website activity, technical identifiers and approximate location
  • Processing and storage locations: International processing, including the United States, under Google's privacy policy
  • Applicable processing basis: Understanding use of the service; consent where required

Google reCAPTCHA

  • Purpose: Bot and abuse protection
  • Personal information handled: Device, connection and interaction information
  • Processing and storage locations: International processing, including the United States, under Google's privacy policy
  • Applicable processing basis: Service security; consent where required

Google Places

  • Purpose: Address lookup
  • Personal information handled: Address search text and technical request information
  • Processing and storage locations: International processing, including the United States, under Google's privacy policy
  • Applicable processing basis: Providing address lookup during registration; consent where required

Meta (Facebook)

  • Purpose: Marketing measurement
  • Personal information handled: Website visit information and technical identifiers
  • Processing and storage locations: International processing, including the United States, under Meta's privacy policy
  • Applicable processing basis: Marketing measurement; consent where required

Cloudflare

  • Purpose: Website security
  • Personal information handled: Connection, request and security-event information
  • Processing and storage locations: Global network; technical information may be processed in the United States and European Union, as described in its transfer information
  • Applicable processing basis: Service security

Countries listed describe our Australian hosting and locations identified in provider information. They do not mean that every item of information is processed in every listed country. Global delivery, support and providers' own service providers may involve other countries, as described in the linked provider terms and privacy information.

Processing Bases

Where the EU General Data Protection Regulation applies, the processing bases above mean:

  • Providing the service: performance of our contract with you, or steps you ask us to take before entering a contract.
  • Service security, service quality and understanding use: our legitimate interests in protecting and improving the Services, where permitted by applicable law.
  • Newsletter marketing: your consent, which you can withdraw by unsubscribing.
  • Marketing measurement: legitimate interests where permitted by applicable law, and consent where required. We do not treat agreement to the Privacy Policy as blanket consent for every use of information.
  • Legal obligations: compliance with applicable legal requirements.

Providers acting independently determine their own processing bases under applicable law and their published privacy terms. See our Privacy Policy for your rights and how to contact our Privacy Officer.