Subprocessors
This list applies from 1 November 2026.
1. What this page is
AgriVale is built on services supplied by other companies. This page names every one of them that processes personal data on our instructions — our processors, and your sub-processors where we act as your processor under the Data Processing Agreement.
For each one it gives the legal entity we contract with, what it does, what reaches it, where it processes, and the safeguard that applies if the processing is outside the European Economic Area.
Section 3 names the other organisations that receive information but are not our processors — because they decide their own purposes, or because you or your browser, not we, send the data to them. They belong in the picture even though they do not belong on this list.
2. Our processors and sub-processors
| Provider | Legal entity | What it does | What reaches it | Where it processes | Transfer safeguard |
|---|---|---|---|---|---|
| Supabase | Supabase Pte. Ltd, Singapore | Authentication, the database, file storage and server functions | All customer data: account and contact details, farm and herd records, animal identification and movements, medicines, production, finance records, uploaded documents and photographs, messages | Ireland (AWS region eu-west-1). Supabase's own sub-processors include Amazon Web Services, Cloudflare, Google and Vercel; Supabase support and administration may be provided from outside the EEA | EU Standard Contractual Clauses, deemed signed on acceptance of Supabase's terms, with the UK Addendum. Supabase's data processing addendum is incorporated into its Terms of Service |
| Vercel | Vercel Inc., Delaware, USA | Hosting the web application, its server functions and scheduled jobs | All web traffic: request paths and parameters, IP-derived information, browser information, and whatever the application logs | Our server functions are configured for Vercel's Dublin region (dub1). Vercel's content delivery network, routing and platform infrastructure are global, and Vercel states its primary processing facilities are in the United States | EU Standard Contractual Clauses, deemed entered into on entering Vercel's agreement, with the UK addendum. Vercel's Data Processing Addendum is incorporated in its terms for customers on Pro and Enterprise plans; AgriVale is on a paid Pro plan |
| OpenAI | OpenAI Ireland Limited (the contracting entity under OpenAI's terms for customers in the EEA) | The AI features: reading documents and statements, classifying transactions, transcription, reading ear-tag photographs, turning notes into records, scheme answers, farm reviews | Receipt, invoice and statement files; bank statement PDFs; transaction details including farm and account-holder names; WhatsApp message text; voice notes; ear-tag and paddock photographs; short capture notes; de-identified farm summaries; scheme documents; fertiliser product names | Globally. OpenAI's sub-processors include Microsoft, Google Cloud, Amazon Web Services, CoreWeave, Oracle and Cloudflare, and content flagged by abuse monitoring may be reviewed by personnel outside the EEA | EEA contracting entity, with onward transfers on the basis of agreements containing Standard Contractual Clauses or an adequacy decision. Data sharing for training is disabled on AgriVale's organisation; content may be retained by OpenAI for up to 30 days for abuse and misuse monitoring and is then deleted |
| Bird | Bird B.V., Netherlands | WhatsApp Business messaging and SMS one-time codes | Mobile numbers, message content, template values, inbound messages and media | Bird's EU region (eu1), per Bird's published regional architecture. Account authentication and administration data is replicated globally | Intra-EEA at the contracting level (Ireland to the Netherlands), so no transfer mechanism is needed between us and Bird. Bird's own onward transfers are made under EU Standard Contractual Clauses |
| WhatsApp Ireland Limited | WhatsApp Ireland Limited (Meta) | Delivering WhatsApp Business messages | Mobile numbers and message content | Listed by Bird as USA / EU | Engaged by Bird as its sub-processor. WhatsApp also operates the network under its own terms with the person receiving the message |
| Resend | Plus Five Five, Inc., California, USA, trading as Resend | Sending email, and receiving email sent to a farm's AgriVale address | Email addresses; verification PIN and administrator code emails; advisor invoices; inbound emails and their attachments; delivery logs | United States. Choosing a sending region changes only where mail is sent from, not where it is stored | EU Standard Contractual Clauses with the UK addendum, pre-signed by Resend and binding on sign-up. Resend retains email and log data for 30 days, and deletes remaining customer data within 90 days of account termination |
| Nylas | Nylas, Inc., California, USA; EU representative RIVACY GmbH, Hamburg | The optional advisor calendar connection — linking an advisor's own work calendar to the advisor portal | An advisor's email address, the calendar connection identifier, and calendar event titles, locations and times | Nylas' European service, which Nylas documents as hosted in the United Kingdom | The United Kingdom has an adequacy decision |
| Mapbox | Mapbox, Inc., Delaware, USA | Map tiles and styles delivered to your device, and server-generated static map images | Your IP address, our access token, your browser or device information, the map view you are looking at, and land block boundaries in static image requests | United States, on Amazon Web Services, with content cached on Mapbox's content delivery network in many regions. Mapbox states it cannot serve its data from one limited geographic region | EU Standard Contractual Clauses (Module Two), incorporated by reference and pre-signed, with the UK addendum. Mapbox is also an independent controller for end-user data it collects under its own product privacy policy — see the Cookie and Storage Policy |
| Open-Meteo | OpenMeteo GmbH, Bürglen, Switzerland | Supplementary weather data — hourly forecasts, pressure, UV, evapotranspiration and modelled soil figures | Farm coordinates only. Open-Meteo logs IP addresses and states its logs may contain coordinates | Switzerland | Switzerland has an adequacy decision, so no Standard Contractual Clauses are required. Open-Meteo deletes its log files after 90 days |
About Nylas. Nylas is engaged only where an advisor chooses to connect their own work calendar to the advisor portal. Where no advisor calendar is connected, nothing reaches Nylas. Farm data is never sent to Nylas in any case.
3. Other recipients — not subprocessors
These organisations receive information, but they are not processing on our instructions. Each decides its own purposes, or receives the data because you or your device sent it.
| Recipient | Legal entity | Why it is not a subprocessor | What reaches it |
|---|---|---|---|
| Department of Agriculture, Food and the Marine | Department of Agriculture, Food and the Marine | An independent controller and statutory recipient. It processes to meet legal obligations it determines itself, not on our instructions | Herd number, tag numbers, animal details and movements, submitted on the farmer's instruction. No personal names |
| Google (Geocoding) | Google Cloud EMEA Limited, Dublin (contracting); Google Ireland Limited as European end controller | Google's Maps terms apply its controller-to-controller data protection terms. There is no Article 28 relationship to document | Only the first three characters of a farm's Eircode — the routing key, which identifies a postal district — with the country, sent from our servers. Never the full Eircode |
| Met Éireann | Department of Housing, Local Government and Heritage | An anonymous, keyless open-data service under a copyright licence. No account, no contract, no instruction relationship | Farm coordinates and our server's IP address |
| Browser push services — Google, Mozilla, Apple | Google Ireland Limited / Mozilla / Apple Distribution International Limited | We have no contract with them and we do not choose them — the advisor's own browser does — and the message is encrypted end to end so they cannot read it | An encrypted payload, plus the subscription address, our identity, the time and the size. Advisor portal only |
| YouTube | Google Ireland Limited | Google applies its own privacy policy and its own purposes to the viewer | Nothing until you tap play on a help video; then whatever the embedded player collects |
| Irish Cattle Breeding Federation | Irish Cattle Breeding Federation Society Limited | We transmit nothing. The link is inert until you tap it, and the request is made by your own browser | An animal tag number in the address, only if you follow the link |
| Expo / EAS | 650 Industries, Inc., Burlingame, California, USA | It builds and distributes our app code, not our application data. We do not use its over-the-air update or push services, so no end-user data reaches it | Our source code, build artefacts and app signing credentials, and AgriVale's own account data |
4. Not on either list, deliberately
- No payment provider. Paid billing is not switched on. Nothing will be added here until it is, and we will give notice before it is.
- No analytics, advertising, tag management or session-replay provider, anywhere in AgriVale.
- Sub-sub-processors. Each provider above publishes its own sub-processor list — the underlying cloud providers, content delivery networks and support tools. We do not repeat them here.
5. How we tell you about changes
When we intend to add or replace a subprocessor, we update this page and give at least 30 days' notice before the new subprocessor begins processing.
To be notified, email info@agrivale.ie and ask to be added to subprocessor change notices.
If you are a customer under the Data Processing Agreement, you may object on reasonable data-protection grounds within 30 days of that notice. Section 8 of that agreement sets out what happens then.
6. Contact
AGRIVALE LIMITED Venture Hub, 136 Capel Street, Dublin, D01 T2C9, Ireland Company number 824192 info@agrivale.ie
AGRIVALE LIMITEDCompany No. 824192
Registered office: Venture Hub, 136 Capel Street, Dublin, D01 T2C9, Ireland
info@agrivale.ie
Registered office: Venture Hub, 136 Capel Street, Dublin, D01 T2C9, Ireland
info@agrivale.ie
The rest of the shelf