Subprocessors

Third-party services EXPO uses to deliver the product.

EXPO is operated by EXPO and uses the third-party providers listed below to host, process, and protect customer data. Each provider acts as a subprocessor under our terms of service.

We update this list when subprocessors are added or removed. Material changes — new categories of data, new processing regions — are communicated to customers via the in-product notice banner before they take effect.

Supabase

Supabase Inc. (USA)
Purpose
Postgres database hosting
Data processed
Every operational record: users, organisations, tenants, customers, bookings, orders, payments, vouchers, audit logs.
Processing region
AU (Sydney, ap-southeast-2)
Privacy policy
https://supabase.com/privacy

Railway

Railway Corp. (USA)
Purpose
Application hosting
Data processed
Application memory + ephemeral request logs. No durable customer data is stored on Railway disks.
Processing region
US-West (primary)
Privacy policy
https://railway.com/legal/privacy

Stripe

Stripe Payments Australia Pty Ltd (ACN 160 180 343)
Purpose
Payment processing (gift-card sales + pay-by-link)
Data processed
Cardholder payment data, billing address, email. EXPO never sees the raw card number — Stripe processes it directly via Checkout.
Processing region
AU
Privacy policy
https://stripe.com/au/privacy

Resend

Resend (Pendulum Labs Inc., USA)
Purpose
Transactional email (invites, password resets, alerts)
Data processed
Recipient email addresses + email body content for operational messages. Not used for marketing.
Processing region
US (primary)
Privacy policy
https://resend.com/legal/privacy-policy

BetterStack

Better Stack s.r.o. (Czech Republic)
Purpose
External uptime monitoring
Data processed
Polls the public /health endpoint every 30 seconds. Stores response status + latency. No customer PII.
Processing region
EU (Czech Republic)
Privacy policy
https://betterstack.com/privacy
Last updated 2026-09-11 · Questions? Email privacy@expoplatform.com.au
See also the platform status page.