Skip to content
Candoo

Sub-Processors

Last updated: October 4, 2026

Candoo Solutions, Inc. uses the following third-party service providers (“sub-processors”) to deliver our services. We update this list when our vendor relationships change. For questions about how we process your data, see our Privacy Policy.

Infrastructure & Data

  • Supabase — Database, authentication, edge function hosting, and file storage. Processes customer and Provider data, and all platform content. United States.
  • Fly.io — Hosting for our malware-scanning service that inspects uploaded attachments. Processes file contents of customer/Provider attachments. United States.

Payments

  • Stripe — Payment processing, subscriptions, and invoicing. Processes payment and billing data. United States / global.

Property Data

  • RentCast — Property record lookups from a service address to enrich home profiles. Processes property street addresses.

Communications

  • Twilio — SMS delivery and inbound message routing. Processes phone numbers and message content. United States.
  • Resend — Transactional and inbound email. Processes email addresses and message content. United States.
  • Slack — Internal staff notifications. When you submit a form or book a service, our team receives an alert containing your name, email address, phone number, and property address so we can respond. United States.

AI / LLM Services

The following providers process Provider-side message content when the AI Message Assist feature is enabled. Message content is not used by these providers to train their models, consistent with their enterprise data-processing terms.

  • Lovable AI Gateway — Routing layer between Candoo and the model providers listed below. Processes Provider-side message content. United States / global.
  • Anthropic (Claude) — Large language model inference. Processes Provider-side message content. United States.
  • Google (Gemini) — Large language model inference. Processes Provider-side message content. United States / global.
  • OpenAI (GPT) — Large language model inference. Processes Provider-side message content. United States.

Maps & Location

  • Google Maps Platform — Street View imagery and address autocomplete/geocoding. Processes street addresses. United States / global.

Scheduling

  • Calendly — Appointment scheduling for consultations and onboarding kickoffs. Processes calendar metadata, attendee names, and email addresses. United States.

Error Monitoring

  • Sentry — Application error and performance monitoring. Processes stack traces; personally identifiable information is scrubbed at the SDK layer. United States / EU.

Security

  • Cloudflare — Bot and spam protection on our website forms (Turnstile). Processes your IP address and browser and device characteristics to tell people from automated traffic. It does not read what you type into a form. Global network; United States.

Product Analytics

The providers below are active by default on our marketing pages, including before you make a cookie choice. They stop when you choose “Necessary only”, turn off How you use the site in Your Privacy Choices, or browse with Global Privacy Control turned on — and we delete the cookies they have already set. That choice is saved in your browser for candoo.co and does not carry into your signed-in account.

  • Google Analytics 4 — Site analytics. Processes pseudonymous identifiers. On the property candoo.co reports to, Google’s cross-site advertising features are turned off, so it is not used to build ad audiences. United States / global.
  • PostHog — Product analytics, feature flags, and session replay. Runs on our marketing pages and on the pages you see when signed in. Processes pseudonymous user identifiers, page views, events, and replays of site interactions; what you type into a form is masked and never recorded, and replays may include on-screen text. Linked to your account email when you are signed in, and to nothing but a pseudonymous identifier when you are not. United States / EU.

Customer Support

  • Tidio — Live-chat widget on marketing pages. Processes visitor identifiers and chat content. United States.

Marketing Analytics & Advertising

The following providers are active by default, including before you make a cookie choice. They stop when you choose “Necessary only”, turn off Advertising in Your Privacy Choices, or browse with Global Privacy Control turned on — and we delete the cookies they have already set.

  • Google Ads — Conversion tracking and remarketing. Processes hashed identifiers. United States / global.
  • Meta (Facebook Pixel) — Ad measurement and retargeting. Processes hashed identifiers. United States.
  • Nextdoor — Ad measurement and retargeting. Processes pseudonymous identifiers. United States.

Change Notifications

We refresh this list when our vendor relationships materially change. To be notified of updates in advance, email [privacy@candoo.co](mailto:privacy@candoo.co?subject=SUBSCRIBE: Sub-Processors) with subject SUBSCRIBE: Sub-Processors.

Contact

Questions about this list or how we process your data?

Email: privacy@candoo.co

Mail: Candoo Solutions, Inc., Attn: Privacy Team