Vendor Data-Processing Posture

Last updated: 2026-02-21

OneCount Pty Ltd · ACN 695 536 415 · ABN 29 695 536 415

This is the plain-English processing posture for vendors that are actually wired into the OneCount website, mobile app, or Supabase Edge Functions. It is not a complete legal data processing agreement; it is the operational view a customer can verify against the code.

Current subprocessors

Vendor	Repo evidence	What it does	What data it can see
Supabase	Website uses `@supabase/ssr` and `@supabase/supabase-js`; app and Edge Functions use `@supabase/supabase-js`. Project docs identify project `llwvgdngmylduqwvavsx` in Southeast Asia (Singapore).	Authentication, Postgres database, storage, realtime sync, and Edge Function execution.	Account identity, org and venue membership, stocktake sessions, catalog items, inventory movements, supplier and invoice records, AI usage rows, webhook-derived subscription status, and files or images uploaded to product workflows.
OpenAI	Edge Functions import `npm:openai@4`. `ai-intelligence` calls OpenAI for business queries and structured insights; `invoice-ai` and `shelf-count-ai` also call OpenAI for document and vision workflows.	AI analysis, business-question answering, invoice parsing, and shelf-photo interpretation.	The prompt and attachments needed for the selected AI task: org-scoped business context, inventory and count data, variance or supplier summaries, invoice text or images, shelf photos, and the manager's question. OpenAI API keys stay server-side.
RevenueCat	Mobile billing imports `react-native-purchases`, configures Purchases with the signed-in Supabase user ID as `appUserID`, and receives subscription webhooks in `revenuecat-webhook`.	Subscription entitlement checks, purchases, restores, offerings, and billing webhooks.	App user ID, entitlement IDs, active subscription tier, purchase or restore events, product/package identifiers, event environment, and webhook metadata. It does not need stocktake line items or inventory counts.
Sentry	Mobile app imports `@sentry/react-native` and initializes Sentry only when `EXPO_PUBLIC_SENTRY_DSN` is configured. The init sets `sendDefaultPii: false`, release/dist tags, traces, profiles, and replay on error.	Crash reporting, error diagnostics, performance traces, and on-error replay diagnostics.	Error messages, stack traces, release/build identifiers, device and performance diagnostics, breadcrumbs added by the app, and limited replay context when an error is captured. It should not receive customer inventory as a primary data store, but nearby error context can include product or workflow metadata.
Vercel	Website package includes `@vercel/analytics`; root layout renders `<Analytics />`; the provider wires custom events through `track`. Deployment script uses `npx vercel deploy --prod`.	Website hosting, Next.js runtime, deployment logs, and website analytics.	Website requests, page views, custom analytics events, runtime logs, deployment metadata, and environment variables needed by the website runtime. Logged form or server errors may include the fields involved in that request.

Boundaries

OneCount should keep direct customer operating data in Supabase unless a feature needs a specific vendor call. AI requests send only the task context needed to answer or parse the current request. Billing data goes through RevenueCat rather than being mixed into inventory workflows. Sentry and Vercel are observability and hosting processors, not source-of-record systems for customer stock data.