Tideloc Orders
Subprocessors
Appendix A — Subprocessor Inventory
Last updated: 21 June 2026
About this page
This page forms Appendix A to the Tideloc Orders Privacy Policy and should be read together with it. It lists every third party that Tideloc Pty Limited (ABN 68 698 706 115, ACN 698 706 115), trading as Tideloc Orders (“Tideloc”, “we”, “us”), engages to process personal information on its behalf, or that otherwise handles personal information in connection with the platform.
For each provider we set out its purpose, the categories of data it handles, and where it is hosted. Personal data stored by Tideloc is held onshore in Sydney, Australia (Supabase). Some providers are located overseas; those overseas disclosures are made under Australian Privacy Principle 8 and are summarised below.
Subprocessor inventory
| Name | Purpose | Data categories | Location / country |
|---|---|---|---|
| Supabase | Database, authentication, realtime, and storage | Cafe owner and staff identifiers, contact details and ABN; end-customer name, email, phone and order history; order content (menus, items, modifiers); admin audit logs. Excludes card data. | Sydney, Australia (AWS ap-southeast-2) — onshore |
| Vercel | Web application hosting and edge runtime | Request logs and metadata only. Personal data passes through in transit; nothing is persisted beyond short-term observability logs (typically 24–72 hours). | United States (overseas) — global edge; logs processed in the US |
| Stripe | Online card payment processing (Stripe Connect) | Card number (held only by Stripe — never transmitted to or stored by Tideloc), payment amount, customer email and phone where passed through. Stripe is an independent controller of card data. | United States (overseas) — Australian operating entity (Stripe Payments Australia Pty Ltd) |
| Square | Online card payment processing (Square Pay) | Card data (held only by Square — never transmitted to or stored by Tideloc), payment amount, customer email and phone where passed through. Square is an independent controller of card data. | United States (overseas) — Australian operating entity |
| Resend | Transactional email delivery | Recipient email address, sender (cafe) name, and email content (order details, totals, pickup time) for confirmations, ready notifications, refund receipts, reconciliation reports, and admin notifications. | United States (overseas) |
| Anthropic | AI menu-import extraction (Claude API) | Menu content only — item names, descriptions, prices, dietary notes. No customer personal information is ever sent. Content is not retained beyond the API call and is not used to train models by default. | United States (overseas) |
| GitHub | Source code repository hosting | Source code only. No customer or end-customer personal information is stored in the repository; secrets and credentials are not committed. | United States (overseas) — Microsoft Azure infrastructure |
Cross-border transfer disclosure (APP 8)
Under Australian Privacy Principle 8, individuals are entitled to know when their personal information may be disclosed to overseas recipients. Personal information processed by Tideloc may be disclosed to the following overseas recipients in the course of providing the platform:
- Vercel (United States) — request handling.
- Stripe (United States) — card payment processing.
- Square (United States) — card payment processing.
- Resend (United States) — email delivery.
- Anthropic (United States) — menu content extraction only.
- GitHub (United States) — source code only, no personal data.
Supabase, which stores the platform's personal information, is hosted onshore in Sydney, Australia (AWS ap-southeast-2), with data residency restricted to that region by project configuration — it is not an overseas disclosure.
Tideloc has taken reasonable steps to ensure each overseas recipient handles personal information consistently with the Australian Privacy Principles, including reviewing each provider's published privacy practices and security certifications.
Changes to this inventory
We update this inventory whenever a subprocessor is added, removed, or materially changes its role. The current version is always available at this page. Material changes will be flagged here for at least 30 days before they take effect. Cafe customers may object to a new subprocessor by giving us written notice within that 30-day period.
Contact
Tideloc Pty Limited (ABN 68 698 706 115, ACN 698 706 115), trading as Tideloc Orders. Registered office: 115 Kembla St, Wollongong NSW 2500.
This appendix forms part of our Privacy Policy. See also our Terms of Service.