Subprocessors and Data Location
Version 2026-10-13 · effective October 13, 2026
El Café de los Sentidos, S. de R.L. de C.V.
This page lists the providers that process personal data on behalf of El Café de los Sentidos, S. de R.L. de C.V. to operate Koffe Cupping, and where information is stored. It forms part of the Data Processing Agreement and the Privacy Notice.
1. Where your data is
- Database and backups: United States, AWS us-east-1 (Northern Virginia), through Neon.
- Application: United States, Vercel’s iad1 region (Washington, D.C.). Public pages and static files may be served from Vercel’s global network.
- Files (Marketplace photos and exports): Vercel, United States.
- Your device: in offline mode, the browser keeps a working copy and pending entries until they sync.
- Backups: 7-day point-in-time recovery, daily copies kept 14 days and weekly copies kept 35 days, in the same region.
2. Subprocessors
- Provider
- Vercel Inc.
- Purpose
- Application hosting and compute, content delivery network, file storage (photos and exports), isolated AI Lab environments, AI routing (AI Gateway) and cookieless web analytics
- Data
- All service data in transit, files you upload, technical logs (IP, browser)
- Location
- United States (iad1 region, Washington, D.C.); public content cached on Vercel’s global network
- When
- Always
- Provider
- Neon, Inc. (Databricks)
- Purpose
- Primary database and its backups
- Data
- Account, workspace, cupping session, Marketplace and billing data
- Location
- United States (AWS us-east-1, Northern Virginia)
- When
- Always
- Provider
- Resend (Plus Five Five, Inc.)
- Purpose
- Transactional email: verification, sign-in links, invitations, exports and notices
- Data
- Recipient name and email, message content, delivery events
- Location
- United States
- When
- Always
- Provider
- Stripe, Inc.
- Purpose
- Plan payments and subscription management
- Data
- Billing name and email, card details (collected by Stripe directly), amounts, country
- Location
- United States and other Stripe locations
- When
- When you buy or manage a paid plan
- Provider
- Functional Software, Inc. (Sentry)
- Purpose
- Error detection and diagnostics
- Data
- Technical error data, pseudonymous identifiers, browser and device; personal data is scrubbed before sending
- Location
- United States
- When
- Always
- Provider
- OpenAI, L.L.C.; Google LLC; xAI LLC (vía Vercel AI Gateway)
- Purpose
- Generate the results of the AI features you use: reports, analyses, suggestions, translations and Koffe AI
- Data
- The content you send to the feature and the workspace context needed to answer
- Location
- United States (providers may process in other regions)
- When
- Only when you use an AI feature
Provider Purpose Data Location When Vercel Inc. Application hosting and compute, content delivery network, file storage (photos and exports), isolated AI Lab environments, AI routing (AI Gateway) and cookieless web analytics All service data in transit, files you upload, technical logs (IP, browser) United States (iad1 region, Washington, D.C.); public content cached on Vercel’s global network Always Neon, Inc. (Databricks) Primary database and its backups Account, workspace, cupping session, Marketplace and billing data United States (AWS us-east-1, Northern Virginia) Always Resend (Plus Five Five, Inc.) Transactional email: verification, sign-in links, invitations, exports and notices Recipient name and email, message content, delivery events United States Always Stripe, Inc. Plan payments and subscription management Billing name and email, card details (collected by Stripe directly), amounts, country United States and other Stripe locations When you buy or manage a paid plan Functional Software, Inc. (Sentry) Error detection and diagnostics Technical error data, pseudonymous identifiers, browser and device; personal data is scrubbed before sending United States Always OpenAI, L.L.C.; Google LLC; xAI LLC (vía Vercel AI Gateway) Generate the results of the AI features you use: reports, analyses, suggestions, translations and Koffe AI The content you send to the feature and the workspace context needed to answer United States (providers may process in other regions) Only when you use an AI feature 3. Services used only if you choose them
These services receive data only when a user chooses them; they process it under their own terms.
- Provider
- Google LLC
- Purpose
- Sign in with Google
- Data
- Name, email and profile photo
- Location
- Global
- When
- If you choose to sign in with Google
- Provider
- Specialty Coffee Association (SCA)
- Purpose
- SCA CVA repository
- Data
- Session results with pseudonymized cuppers (never their emails)
- Location
- Per SCA’s infrastructure (United States)
- When
- Only if a user with permission chooses to upload a session
- Provider
- OpenAI (ChatGPT / Codex)
- Purpose
- AI Lab conversations with your own ChatGPT account
- Data
- Your messages and the context you share in the conversation
- Location
- United States
- When
- Only if you connect your account; your OpenAI agreement applies
Provider Purpose Data Location When Google LLC Sign in with Google Name, email and profile photo Global If you choose to sign in with Google Specialty Coffee Association (SCA) SCA CVA repository Session results with pseudonymized cuppers (never their emails) Per SCA’s infrastructure (United States) Only if a user with permission chooses to upload a session OpenAI (ChatGPT / Codex) AI Lab conversations with your own ChatGPT account Your messages and the context you share in the conversation United States Only if you connect your account; your OpenAI agreement applies 4. Change notices
We publish any new or replacement subprocessor here at least 15 calendar days in advance and email the owners of workspaces on a paid Plan. To object or ask questions, write to contacto@cafedelossentidos.com.
- Date
- October 13, 2026
- Change
- Initial publication of the list.
Date Change October 13, 2026 Initial publication of the list.