Subprocessors
Last updated: July 27, 2026
Softserve Software LLC d/b/a Car Storage SoftwareAbout This List
We use the following third-party subprocessors to deliver our Service. Each is bound by a data processing agreement imposing confidentiality and security obligations materially equivalent to our own Data Processing Agreement, and each processes personal data only to provide services to us.
Softserve Software LLC is itself certified under the EU-U.S. Data Privacy Framework and the UK Extension — see our Data Privacy Framework Notice. Where we disclose EEA or UK personal data to a subprocessor, we require protection at least equivalent to the DPF Principles and remain liable as described in that notice.
We update this page before adding or replacing subprocessors. To receive change notifications, email matt@carstoragesoftware.com with the subject “Subprocessor notifications.”
Current Subprocessors
| Subprocessor | Purpose | Personal data processed | Location | Transfer safeguards |
|---|---|---|---|---|
| Vercel Inc. | Application hosting, serverless compute, and file/object storage (uploaded photos and documents) | All Service data in transit and uploaded files | United States (global edge network) | EU–U.S. Data Privacy Framework; Standard Contractual Clauses (DPA) |
| Neon, Inc. | Primary managed PostgreSQL database hosting with encryption at rest and automated backups | All structured Service data (accounts, customers, vehicles, records) | United States | Standard Contractual Clauses (DPA); encryption at rest |
| Stripe, Inc. | Payment processing, invoicing, and payouts (including Stripe Connect and Tap to Pay) | Names, emails, billing addresses, payment credentials (held by Stripe; we never store card numbers) | United States | EU–U.S. Data Privacy Framework; Standard Contractual Clauses (DPA) |
| Straddle, Inc. | ACH payment processing for vendor payments (facility-to-vendor bank transfers, bank account verification, and Nacha authorization records) | Business and account-holder names, bank account and routing numbers (held by Straddle; we never store account numbers), payment amounts, authorization records (timestamp, IP address, user agent) | United States | Standard Contractual Clauses (DPA); bank credentials held by Straddle |
| Twilio Inc. (including SendGrid) | Transactional email, SMS notifications, and optional telephony/voice features | Names, email addresses, phone numbers, message content, call metadata and optional recordings | United States | EU–U.S. Data Privacy Framework; Standard Contractual Clauses (DPA) |
| OpenAI, L.L.C. | AI features: vehicle photo analysis, document processing, and assistant functionality | Photos, document contents, and text submitted to AI features (not used to train OpenAI models per our API terms) | United States | Standard Contractual Clauses (DPA); API data-usage protections |
| Google LLC (Maps Platform) | Address autocomplete and geocoding | Addresses entered into address fields | United States (global) | EU–U.S. Data Privacy Framework; Standard Contractual Clauses |
| Lucky Orange, LLC | Optional session analytics and heatmaps on our marketing surfaces (on by default; visitors can decline) | Page views, session recordings/clicks, IP-derived location, and visitor properties when identified | United States | Standard Contractual Clauses / provider DPA; consent-gated loading |
| Meta Platforms, Inc. | Optional advertising measurement via Meta Pixel (on by default; visitors can decline) | Page views, conversion events, and hashed identifiers when advanced matching is used | United States | EU–U.S. Data Privacy Framework; Standard Contractual Clauses; consent-gated loading |
| Google LLC (Ads / Analytics) | Optional Google Ads tags on our marketing surfaces, and Google Analytics when a facility configures a measurement ID on its public site (on by default; visitors can decline) | Page views, conversion events, and device/browser identifiers | United States (global) | EU–U.S. Data Privacy Framework; Standard Contractual Clauses; consent-gated loading |
| Sendblue, Inc.(optional integration) | iMessage/SMS conversational messaging, only when a facility enables the messaging agent | Customer phone numbers and message content | United States | Data processing terms; enabled per facility |
| Calendly LLC(optional integration) | Appointment scheduling, only when a facility connects Calendly | Booker names, email addresses, and appointment details | United States | Calendly DPA (incorporated into its terms); enabled per facility |
| Salesforce, Inc. (Slack) | Internal notification of marketplace inquiries to our operations team | Inquirer name and contact details from marketplace lead forms | United States | EU–U.S. Data Privacy Framework; Slack DPA |
| Zernio (formerly Late, getlate.dev)(optional integration) | Social media post scheduling, only when a facility enables social publishing | Post content and media the facility chooses to publish | European Union | EU-based provider subject to GDPR; enabled per facility |
| Vehicle data providers (auto.dev; RapidAPI/CarAPI; CarJam NZ; UK DVLA)(optional integration) | VIN decoding, vehicle specifications, and license plate lookups where configured | VINs and license plate numbers submitted for lookup (no names or contact details) | United States / New Zealand / United Kingdom | Provider API terms; only vehicle identifiers are transmitted |
| Intuit Inc. (QuickBooks Online)(optional integration) | Accounting synchronization, only when a facility connects QuickBooks | Customer names, invoices, payment records synced to the facility's own QuickBooks account | United States | Enabled and authorized by the facility; Intuit DPA applies |
| Xero Limited(optional integration) | Accounting synchronization, only when a facility connects Xero | Customer names, invoices, payment records synced to the facility's own Xero account | New Zealand / United States | Enabled and authorized by the facility; Xero DPA applies |
Security Measures
Key technical and organizational measures we apply across the Service:
- TLS encryption for all data in transit; encryption at rest for databases, file storage, and backups
- Tenant isolation with role-based, least-privilege access controls
- Multi-factor authentication required for platform administrator access
- Security audit logging of authentication and privacy-relevant events
- Automated backups with defined retention and disposal schedules
- Documented incident response with 72-hour customer breach notification
Detailed policies: Information Security, Access Controls, Data Retention and Disposal.
Contact
Softserve Software LLC
d/b/a Car Storage Software (carstoragesoftware.com)
Email: matt@carstoragesoftware.com
Address: 3343 Port Royale Dr S, Fort Lauderdale, FL 33308
Powered by carstoragesoftware.com