Sub-processors

These providers are involved in every account. Data an operator uploads about their own customers passes through them.

• Supabase. Database, authentication, and file storage. Holds operator accounts, pool and customer records, chemistry readings, and uploaded photos. Hosted in the United States.
• Render. Application hosting and scheduled jobs. Runs the web application and the background jobs that generate visits and send reminders.
• Stripe. Subscription billing for operators, and payment processing between a pool owner and their operator. Card details are entered directly with Stripe and never reach PoolBeacon systems.
• Resend. Transactional email delivery, including visit reports, invoices, and account notices. Receives recipient names and email addresses.
• Sentry. Application error monitoring. Receives technical diagnostics, which can include an account identifier and the page an error occurred on.

Used to place pools on a map and plan routes. These providers receive service addresses and coordinates, not customer contact details.

• MapTiler and OpenStreetMap. Map tiles and base map data.
• U.S. Census Geocoder. Converts a service address into coordinates.
• OSRM. Route and drive-time calculation between stops.

These providers are used only by accounts that turn on the AI phone receptionist. If the add-on is off, they receive nothing.

• Vapi. Telephony and voice handling for the receptionist. Receives call audio, the caller phone number, and transcripts.
• Anthropic. The language model that understands the caller and drafts the response. Receives the call transcript.

These relate to our own website, not to operator or pool-owner records.

• Cloudflare. DNS and cookieless website analytics. Measures overall traffic in aggregate and does not set cookies or build a profile of you.
• Google. Advertising measurement on our public marketing pages, so we can tell whether an ad we paid for led to a signup. It sets one cookie and reports that a visit reached a given page. It is not loaded inside an operator account, the field app, a customer portal, or on any private link we email to a customer, and it is not loaded at all when a browser sends Global Privacy Control or Do Not Track. We do not upload customer lists to Google and we do not build advertising audiences.

We also record basic page-view and engagement events in our own Supabase database. Those stay first-party: no cookies, no third party receives them, and they honor a browser Do Not Track or Global Privacy Control signal.

Advertising measurement is limited to the Google tag described above, and it touches website visitors only. No operator record and no pool-owner record is ever sent to an advertising provider, sold, or used to target anyone. See the Privacy Policy for how to opt out.

We update this page when we add or remove a provider that handles personal information. For questions, or to ask about a specific provider, contact hello@poolbeacon.com.