Last updated: April 4, 2026
A sub-processor is a third-party service provider engaged by CashTrack to process personal data on behalf of our users (data controllers). We maintain this page to provide transparency about which services have access to your data and the purpose of that access.
In accordance with our Data Processing Agreement, we notify account holders before engaging new sub-processors and provide the right to object.
| Name | Purpose | Data Processed | Location | DPA Status |
|---|---|---|---|---|
| Vercel Inc. | Application hosting & CDN | Request logs, IP addresses | US/EU | DPA in place |
| Supabase Inc. | Database hosting | All application data | EU (Frankfurt) | DPA in place |
| Paystack (Stripe) | Payment processing | Payment details, business info | Nigeria/US | DPA in place |
| Flutterwave | Payment processing | Payment details, business info | Nigeria/US | DPA in place |
| Mono Technologies | Bank account linking & transactions | Bank account data, transactions | Nigeria | DPA in place |
| AWS (via Supabase) | Cloud infrastructure | Encrypted database storage | EU | DPA in place |
When CashTrack intends to engage a new sub-processor or replace an existing one, we will notify the account owner via email at least 30 daysbefore the new sub-processor begins processing personal data. The notification will include the sub-processor's name, purpose, data processed, and location.
Account holders have the right to object to a new sub-processor within 14 days of receiving the notification. Objections must be submitted in writing to privacy@cashtrack.ng and must include reasonable grounds for the objection. CashTrack will work in good faith to address any legitimate concerns. If the objection cannot be resolved, either party may terminate the affected services in accordance with the Terms of Service.
For questions about our sub-processors or to submit an objection, please contact: