Subprocessors
Last updated October 22, 2026
Aspatuck LLC uses these providers to run PTO Fox. Each handles only what its part needs, under its own security and privacy commitments. We update this page before adding a new provider that handles employee data. Questions go to support@ptofox.com.
| Vendor | What it does | Data it handles | Location |
|---|---|---|---|
| Supabase | The database | Everything a company enters in PTO Fox: its people, policies, time off, requests, notes and audit trail | United States |
| Netlify | Hosting: serves the website and runs the app's server | Every request passes through it; its logs hold IP addresses, browser type and the pages requested | United States |
| Clerk | Sign-in, accounts and invitations, and the emails those send | Name, email address and sign-in records of everyone who signs in | United States |
| Resend | PTO Fox's own emails: requests, decisions, cancellations, the trial and account notices | The recipient's email address, and the person's name, dates and any note in a request email | United States |
| Stripe | Card payments, sales tax, receipts and invoices | The company's name, the admin's email address, the billing address and the card (kept by Stripe, never by us) | United States |
| Microsoft 365 | Our support mailbox | Whatever is written to support@ptofox.com, including the support form's messages | United States |
| Porkbun | Our domain name, and forwarding mail sent to support@ptofox.com | Messages to support@ptofox.com pass through it on their way to our mailbox | United States |
| Analytics and ad measurement on our public website only | Pages visited, the link or ad a visitor came from, browser and approximate location, Google's own identifiers; never anything a company enters about its employees | United States | |
| Meta | Ad measurement on our public website only (the Meta Pixel and the Conversions API): website visitors only, no employee data | Pages visited, the ad a visitor came from, browser and device details, Meta's own identifiers; when a trial starts, a hashed copy of the admin's email and a hashed id for the company; never anything a company enters about its employees | United States |
Card details never reach PTO Fox: they are entered on Stripe’s own page and kept by Stripe. Google is used only on our public website, never inside the app, as our Privacy Policy describes.