Legal
This document is provided as-is and is not legal advice. Consult counsel before relying on it.
Last updated 2026-08-28. This is the list of third-party subprocessors Pocket-CFO uses to operate the service, what each one receives, and its current status.
Purpose: database, authentication, and file storage for the entire product. Data received: all customer data Pocket-CFO stores, including account and authentication information, company profile data, normalized accounting records, mappings, scenarios, and encrypted OAuth connection tokens. Status: active for every customer.
Purpose: narrates already-computed KPI figures into a plain-English Monthly CEO Financial Brief when you use that feature. Data received: a sanitized, derived fact packet only — company name, period dates, the already-computed KPI figures, and drafting instructions. OpenAI does not receive raw accounting records, transaction detail, or account numbers. Status: active when you use the briefing feature.
Purpose: web subscription billing and payment processing for purchases made on the Pocket-CFO website. Data received: payment and billing details you enter directly into Paddle's own checkout; Pocket-CFO does not handle your card data. Our stored copy of Paddle's webhook events has customer, billing, address, and business fields redacted before it is saved. Status: active for all web subscriptions.
Purpose: manages mobile in-app-purchase subscription entitlements for the iOS and Android apps. Data received, when enabled: purchase and entitlement events relayed from Apple and Google, keyed to your organization. Status: not currently enabled — the webhook integration exists in code but is not turned on in this build.
Purpose: accounting connector you choose to connect so Pocket-CFO can sync your books. Data received: your authorized chart of accounts, transactions, and related financial data by OAuth; connection tokens are encrypted at rest. Status: active — QuickBooks supports live backend OAuth and server-side sync once you connect it.
Purpose: additional accounting connectors you may choose to connect. Data received, when enabled: your authorized chart of accounts, transactions, and related financial data by OAuth. Status: not currently enabled — these connectors run on deterministic mock fixtures in this build, and live API authorization is intentionally not wired yet, so no real customer data reaches these vendors today.
Purpose: product usage analytics. Data received, when enabled: usage, device, and interaction data, and only if you accept analytics cookies. Status: not currently enabled — no tracking ID is configured in this build; the consent-gated code exists but stays inert without one.
Purpose: product analytics. Data received, when enabled: usage and interaction data, and only if you accept analytics cookies; page content is masked and session recording stays disabled even when active. Status: not currently enabled — no API key is configured in this build; the consent-gated code exists but stays inert without one.
Purpose: privacy-preserving page-view and traffic analytics for the Pocket-CFO website. Data received, when enabled: page path, referrer, and coarse device and country information, and only if you accept analytics cookies. Vercel Web Analytics is cookieless and does not build a cross-site profile; the page URL is stripped of its query string and fragment before any event is sent, so no token or search term reaches the vendor. Status: active on the website for visitors who accept analytics cookies — unlike the other analytics vendors it needs no account key, so it works as soon as it is deployed. It is not used in the iOS or Android apps.
Purpose: session-replay analytics. Data received, when enabled: session and interaction data, and only if you accept session-replay cookies. Status: not currently enabled — no site ID is configured in this build; the consent-gated code exists but stays inert without one.
Purpose: session-replay and behavioural analytics. Contentsquare is the same company as Hotjar. Data received, when enabled: session recordings and interaction data, and only if you accept session-replay cookies. Status: not currently enabled — no tag ID is configured in this build; the consent-gated code exists but stays inert without one.
Purpose: sends backend transactional email, such as advisor-deliverable notifications and feedback confirmations. Data received: recipient email address and the content of the specific message being sent. Status: required configuration for the affected backend service to start in production; core account-verification and password-reset email is sent by Supabase Auth directly and does not depend on this vendor.
Purpose: hosts the web application bundle and the backend API server. Data received: whatever infrastructure-level access is inherent to running the application and serving its network traffic; the specific provider is a deployment choice and is not fixed in the application code. Status: active.
Purpose: mobile app distribution and, when used, in-app payment processing for the iOS and Android apps. Data received, when enabled: whatever device, distribution, and purchase data the App Store or Play Store ordinarily collects for an installed app. Status: not currently enabled — the mobile apps have not yet been submitted to the App Store or Google Play.
