Subprocessors.
The third-party services that process personal data when you use Just Arrived, what each of them touches, and where the data goes.
Last updated 23 August 2026
The list
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Supabase | Database, authentication and file storage | Visitor check-in records, employee directory, administrator accounts, uploaded brand assets | EU region |
| Lovable | Application hosting and deployment | All service data, served through the hosted application | EU region |
| Resend | Transactional email delivery | Visitor and host names and email addresses in arrival notifications, invitations and evacuation safety links | EU region |
| Stripe | Subscription billing and payment processing | Administrator billing contact details and VAT identifiers. No visitor data | EU / United States |
| Slack Technologies | Arrival notifications to hosts | Visitor name, company, host and office — only when the customer connects Slack | United States |
| Microsoft | Arrival notifications via Microsoft Teams | Visitor name, company, host and office — only when the customer connects Teams | EU / United States |
| Administrator sign-in; arrival notifications via Google Chat | Administrator account email; visitor name, company, host and office — only when the customer connects Google Chat | EU / United States | |
| Discord | Arrival notifications to hosts | Visitor name, company, host and office — only when the customer connects Discord | United States |
Chat platforms are opt-in
Slack, Microsoft Teams, Google Chat and Discord only receive data when your organization actively connects that channel on the Integrations page, and only for the hosts who have the channel switched on. If you never connect a chat platform, no data is ever sent to it.
Bring-your-own credentials
Microsoft Teams and Google Chat can run on your organization's own bot registration instead of ours. In that setup your credentials are stored encrypted and server-only, and arrival messages flow through your own app registration — under your own agreement with Microsoft or Google.
Changes to this list
Material changes — adding or replacing a subprocessor — are announced by email to administrator accounts with at least 30 days notice, giving you a reasonable opportunity to object, as described in the data processing agreement.
Questions about a subprocessor: privacy@justarrived.io.