Supplier and Subprocessor Schedule
Updated 25 October 2026
This Schedule identifies suppliers that may process personal data in connection with Tarlara services. A supplier is a Subprocessor where it processes Customer Personal Data for Tarlara while Tarlara acts as Processor. For Tarlara Home and Tarlara Premises, where Tarlara is the Controller, the same suppliers process personal data as Tarlara’s processors.
| Provider and status | Purpose and information | Processing location and safeguard |
|---|---|---|
| Supabase — current | Database, authentication and file storage. Account information, Customer records and uploaded files. | Primary Customer Data environment is configured in the EEA. |
| Cloudflare — current | Application hosting and delivery, security and storage, including storage of backup copies (encrypted before upload since 25 October 2026 with a key Cloudflare does not hold, and deleted within 30 days), and transactional email delivery (Cloudflare Email Service). Network and security information, protected stored data, and email recipients and content. | Global service. |
| OpenAI API — current where AI is used | AI-assisted functionality, including Tarlara Home’s Assist, label and receipt reading, type suggestions and manual search (which uses the provider’s web search), and Lara in Tarlara Premises. Information submitted for the requested AI task and generated output. | Processing outside the UK may occur. |
| GitHub Actions — current | Automated operational workflows, including scheduled backups and deletion jobs. Information processed temporarily by an enabled workflow. | Hosted processing location may vary. |
| Microsoft 365 — current | Business, support, privacy and legal communications. Contact details, correspondence and attachments. | |
| Stripe — current | Payment processing. Billing contact, transaction and payment information. Stripe may act independently for regulated and fraud-prevention purposes. |
Independent providers
These providers receive personal data from Tarlara but use it as independent controllers under their own terms. They are not Tarlara’s subprocessors.
| Provider and status | Purpose and information | Processing location and safeguard |
|---|---|---|
| Google (Google Maps Platform) — not yet switched on | Address search (“Find your address”) in Tarlara Home and Tarlara Premises, under Google’s controller-to-controller terms. The text typed into the search box (in Tarlara Premises, possibly a business name) and a reference linking one search. No name, email address or account details. | Processing outside the UK may occur. The transfer safeguard is confirmed before address search is switched on. |
International transfers
Where a restricted transfer occurs, Tarlara uses an appropriate mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. Further information or a copy of the applicable safeguard can be requested from privacy@tarlaradigital.com.
Changes
Tarlara maintains this Schedule as relevant providers change and follows the notice and objection procedure in the Data Processing Agreement.