Sub-processors
Who else touches the data, and where.
Last updated · October 16, 2026
Section 01
Sub-processors
Gotcha is operated by BRAIN 2.0 LTD. When you use Gotcha to collect feedback from your users, we process that data on your behalf, and these companies process it on ours. This list is Annex III of our Data Processing Agreement.
Supabase
- Purpose
- Database, authentication and file storage.
- Data
- Everything the Service stores: account details, feedback responses and their context, end-user ids and metadata you pass, submitter emails, bug tickets and notes, and screenshots (private storage bucket).
- Location
- EU: Ireland (AWS eu-west-1).
- Policy
- Supabase privacy policy
Netlify
- Purpose
- Website hosting and the serverless functions that run the API and dashboard.
- Data
- Every request to gotcha.cx passes through Netlify, including request bodies, IP addresses and user agents. Netlify keeps its own request logs.
- Location
- Functions: EU, Ireland (AWS eu-west-1). Static pages and assets: Netlify’s global CDN.
- Policy
- Netlify privacy policy
Upstash
- Purpose
- Rate limiting (Redis).
- Data
- Short-lived counters keyed by API key, account id or account email, the IP address of a roadmap voter, and a hash of the IP address of a marketing-page visitor. Counters expire with their rate-limit window.
- Location
- UK: London (AWS eu-west-2).
- Policy
- Upstash privacy policy
Resend
- Purpose
- Transactional email.
- Data
- Recipient addresses and message content: account and invitation emails to your team, bug-report emails to your team (which contain the feedback text), and notify-back emails to the end users who gave an address.
- Location
- Sending region: EU, Ireland (eu-west-1) for the
braintwopoint0.comdomain. Resend is a US company. - Policy
- Resend privacy policy
Stripe
- Purpose
- Payments and subscriptions for Pro.
- Data
- Billing details of the paying account: name, email, payment method (held by Stripe; we never see the card number) and invoices. No feedback data or end-user data.
- Location
- Stripe’s global infrastructure, including the United States.
- Policy
- Stripe privacy policy
Section 02
What is not on this list
The Service makes no calls to analytics, advertising or AI providers. Webhooks you configure (for example to Slack or Discord) send data to endpoints you choose; those are your recipients, not our sub-processors.
Section 03
Changes
We update this page before a new sub-processor starts receiving personal data, and change the date above. If you have signed our DPA and want to be told directly, or want to object to a change, email info@braintwopoint0.com.