A sub-processor is a third-party service provider that processes personal data on Comiine's behalf so that we can run the Service. This list supports our Privacy Policy and our Data Processing Agreement.
Each provider below is engaged under a written contract that requires it to protect personal data and to process it only on our instructions. Transfers of personal data outside Botswana are governed by the Data Protection Act, 2024 (Act No. 18 of 2024), and are described honestly in the "Where the data sits" section below.
This list was prepared in-house and has not yet been reviewed by a legal practitioner admitted in Botswana.
Notice of changes
We give customers 30 days' prior notice before we add or replace a sub-processor. We do that by updating this page, and by direct notice to the customer's nominated contact. During that period a customer may object on reasonable data protection grounds, and we will work with the customer in good faith to resolve the objection.
Current sub-processors
| Provider | What it does for us | Personal data it handles | Where it processes |
|---|---|---|---|
| Supabase | Primary database, authentication, file storage, the synchronisation functions, and the transactional email that sends sign-in links, invitations and account emails | Account and identity data, and all Customer Data synchronised to the server, including workforce identifiers, photographs and digital signatures | United States, Amazon Web Services region us-east-1 |
| Sentry | Application error and crash monitoring | Device and technical data, app version, stack traces, a pseudonymous user identifier, and anything incidentally captured in error context | Outside Botswana, on Sentry's cloud infrastructure |
| Vercel | Hosting and delivery of our web app and our website | Web request and technical data, such as IP address and request logs. No core Customer Data is stored here | United States and Vercel's global edge network |
| Expo (EAS) | Mobile app build pipeline and over-the-air app updates | Device and technical data, and update check metadata | United States |
Sentry receives nothing unless you switch crash reporting on. Crash reporting is off by default. When it is on, our configuration removes personal data before anything is sent: the default personal-data flag is off, the user is a pseudonymous identifier with no email address, screenshots and view hierarchy capture are off, and our filters mask email addresses and tokens and drop request headers and query strings.
Push notifications are not enabled. Expo builds and updates the app for us. Push message delivery is not switched on in the production app, so no push token is sent to a delivery service today. If that changes, we will update this list first.
We use no separate email provider. Transactional email is sent through Supabase's built-in email service, which is why there is no separate email row above.
Where the data sits, and what we rely on
Our servers are not in Botswana. Our database, authentication and file storage run on Supabase in the United States. Our error monitoring, web hosting, and app build and update services also process limited data outside Botswana.
Botswana designated a list of countries as offering adequate protection in the Data Protection (Transfer of Personal Data) Order, 2022, issued on 29 July 2022. It lists roughly forty five countries, including those subject to the EU GDPR, and in Africa it lists South Africa and Kenya.
The United States is not on that list. We therefore do not claim an adequacy basis for our United States hosting. We rely on the data protection terms and contractual safeguards we hold with each provider, on telling every customer organisation exactly where its data is held, and on the security measures described in the Privacy Policy and in Annex 2 of the Data Processing Agreement.
We are seeking confirmation from a legal practitioner admitted in Botswana on the correct transfer basis, and on whether the Act requires a copy of personal data to be kept inside Botswana. We do not keep a copy inside Botswana today, and we do not claim that we do. Moving hosting to a region inside Africa is on our roadmap. We will update this page and tell customers when the position changes.
Product analytics: what is true
Comiine collects first-party, cookieless product usage events. They exist and they ship in the product today. They record the name of a core action, a timestamp, the organisation, a pseudonymous user identifier, the platform, the app version, and typed non-identifying properties only. Free text is structurally excluded.
Those events are stored in our own Supabase project, in a table we control. They are never sold, never used for advertising, and never shared with an advertising or analytics company. No third-party analytics or tracking service is used, and no sub-processor was added for this. That is why no row above changed when the feature shipped.
If we ever introduce analytics that involves a third party, we will disclose it in the Privacy Policy and add it to the table above before it ships.
Correction, recorded openly. An earlier version of this list said the product contained no product-analytics collection of any kind. That was true when it was written and became false the next day, when first-party cookieless analytics shipped on 17 August 2026. The Privacy Policy and the Retention Policy were updated at the time and this list was not, so for twelve days it asserted a negative the product disproved. It is corrected here rather than quietly deleted, because the paragraph broke the rule it states for itself.
Other points
- Where a provider also acts as a controller for its own limited purposes, such as billing or the security of its own platform, that processing is governed by the provider's own terms.
- We do not use third-party advertising or tracking services anywhere in the product or on our website.
Contact
Questions about this list: privacy@comiine.com. Millyjoy & Co (Proprietary) Limited trading as Comiine, Plot 7414, Mogoditshane, Botswana. Company registration BW00009256082.