Sub-processors
Version 1.0 — Effective August 26, 2026
This Sub-processors List identifies the third-party processors that Base509 LLC (“Base509,” “PetAppro,” “we,” “us,” or “our”) authorizes to process personal information through petappro.com, the PetAppro mobile applications, the PetAppro Provider portal, and related services (collectively, the “Service”) on behalf of a pet-care business that uses PetAppro (“Provider”). A pet owner or other customer of a Provider is an “End Client,” and an owner, administrator, manager, staff member, contractor, or other person whom a Provider authorizes to use its account is an “Authorized User.”
This list forms part of the PetAppro Data Processing Addendum (“DPA”). Terms not defined here have the meanings in the DPA, the Shared Platform Terms, or the Provider Terms. The Privacy Policy explains Base509’s and Providers’ privacy roles. The End Client Terms govern an End Client’s use of PetAppro.
1. Authorized Subprocessors
This table is identical to Annex III of the DPA.
| Subprocessor | Service | Provider Personal Data and processing location |
|---|---|---|
| Supabase, Inc. | Database, authentication, storage, Edge Functions, and backend infrastructure | Account, Provider, client, pet, booking, file, location, and application data; United States and configured service regions |
| Vercel Inc. | Web hosting, content delivery, and serverless infrastructure | Request, account, application, and diagnostic data; United States and global delivery locations |
| Stripe, Inc. and affiliates | Base509 subscription billing and Provider-connected payment processing | Billing identity, transaction metadata, fraud, and payment data; locations described by Stripe |
| Resend, Inc. | Transactional email delivery | Names, email addresses, message content, delivery, and diagnostic data; United States |
| Google LLC | Google Workspace, Google Maps Platform, authentication, and device-platform services | Support communications, map inputs, coordinates, identifiers, and authentication data; global locations described by Google |
| Apple Inc. | Authentication, application distribution, and device-platform services | Account identifiers, application, device, and notification data; global locations described by Apple |
| 650 Industries, Inc. (Expo) | Mobile build, update, delivery, and notification infrastructure | Application, device, account identifier, notification, and diagnostic data; United States and global infrastructure locations |
| Functional Software, Inc. (Sentry) | Error, crash, and performance monitoring | Pseudonymous account, tenant, role, device, application, error, and diagnostic data; United States and configured locations |
The Google LLC entry includes Google Workspace, Google Maps Platform, Google authentication, and Google device-platform and push services. The Apple Inc. entry includes Apple authentication, application distribution, and Apple device-platform and push services. The Expo entry includes Expo application build, update, delivery, and notification infrastructure. Together, the table covers the launch vendor set of Supabase, Vercel, Stripe, Resend, Google Workspace, Google Maps Platform, Expo and platform push services, Apple, Google, and Sentry.
PetAppro supports email one-time code (OTP), email and password, Google sign-in, and Apple sign-in. Provider Owners and Administrators must use time-based one-time-password multi-factor authentication. The authorized infrastructure above supports PetAppro’s launch functions, including account access, booking, Provider-connected payments, precise-location features, communications, application delivery, and operational error monitoring.
Stripe, Google, and Apple may act as independent Controllers for portions of payment, fraud-prevention, identity, app-store, mapping, or platform Processing governed by their own terms. Listing those functions here does not change their legally assigned role.
2. Deliberate exclusions
The following vendors are not Subprocessors for Provider Personal Data and are not included in the authorized list:
- Cloudflare. Cloudflare supplies domain-name registration and DNS functions only and does not process Provider Personal Data for the Service.
- GitHub. GitHub receives source code and development materials, not customer production data.
A change that causes either vendor to process Provider Personal Data requires a role assessment, appropriate contractual protections, and an update to this list before that Processing begins.
3. Changes and objections
Base509 will give a Provider at least 30 days’ advance notice before authorizing a new Subprocessor that will Process Provider Personal Data. The Provider may object during that period on reasonable data-protection grounds. The parties will work in good faith on a commercially reasonable alternative. If no alternative is reasonably available, the Provider may terminate the affected Service before the new Subprocessor begins Processing and receive a prorated refund of prepaid Base509 subscription fees for the unused terminated period.
An emergency replacement needed to protect security, availability, or legal compliance may occur on shorter notice. Base509 will notify affected Providers as soon as reasonably practicable.
4. Contact and notices
Questions and ordinary notices concerning this list may be sent to support@base509.com.
Ordinary notices:
Base509 LLC, 1875 Mission Street, Suite 103 #660, San Francisco, California 94103, United States
Service of process:
Base509 LLC c/o Launch Registered Agent, 1120 Sycamore Avenue, Suite 2G, Vista, California 92081, United States