Subprocessors
Running Kit Catalogue means other companies process parts of your data on our behalf. This is all of them, what each one receives, and the country it is in. The privacy policy describes them by category; this page names them.
Published by NEWEX GLOBAL PTY LTD (ABN 83 703 303 682), of Level 9, Wyndham Building, 1 Corporate Court, Bundall QLD 4217, Australia, which is the company you are dealing with and the one accountable for every processor below.
The current list
| Who | What they receive | Where |
|---|---|---|
| Fly.io | Hosting. Your register, your account and the running product sit on a machine and a volume they operate. | Sydney, Australia |
| Tigris Data | Your photographs, and the nightly backup of the register itself. Every picture you take is stored here, and once a night a copy of the whole database is written here too. Both sit in buckets pinned to Sydney, so neither leaves Australia at rest. | Sydney, Australia |
| Amazon Web Services | This website, and the files it is made of. Nothing from your register. | Sydney, Australia |
| OpenRouter, and the model provider it routes to | Your photographs and the description of an asset, at the moment it is analysed. | United States |
| Brave Search | Search terms built from an asset’s description, such as a make, model and year. Not your photographs. | United States |
| NHTSA vPIC | A vehicle identification number, when one is decoded. | United States |
| Resend | Your email address and the message, when we send you a sign-in code or a notice about your account. | United States |
| Stripe, and Link, its checkout | When you pay for a plan: your email address, your account’s plan, and how far it is over what the plan includes, to bill you. Card and billing details you enter at checkout go to them directly and never reach us. Link sells you the subscription, so its own privacy policy covers your payment. | United States |
| Google Analytics | How this website is used. It does not run inside the product, and it never sees your register. | United States |
Where Australian law applies, sending your information to a recipient outside Australia is a cross-border disclosure under Australian Privacy Principle 8, and we take reasonable steps to ensure those recipients handle it consistently with the APPs. Where UK or EU law applies, we rely on the UK International Data Transfer Addendum and the European Commission’s Standard Contractual Clauses.
When it changes
This page is the current list, not a snapshot. If we add a processor that handles personal information we update it here, and where the law requires it we will tell you before the change takes effect.
It is a separate page from the privacy policy on purpose. Changing a supplier should not mean reissuing a policy you have already read, and a list copied into a document that is dated once a year is a list that is wrong for most of the year.
If you want to be told when it changes, email support@kitcatalogue.com and we will write to you.
What is not on it
Nobody is paid to receive your data, and nobody on this list may use it for anything except the job we engage them for. We never sell your data.
People you publish to yourself are not subprocessors and are not listed here. A sale page or an instructions page puts part of a record in front of whoever you choose, because you switched it on for that item. The privacy policy says what each of those shows.