Last updated July 3, 2026
Sub-processors
Listd is a small team. To run the marketplace we share limited data with a small number of trusted third-party vendors (“sub-processors”). This page lists every vendor with access to Listd data, what data they see, and where they process it. This page is authoritative — the Privacy Policy references this list.
We update this page whenever we add or remove a vendor. Want an email whenever we change it? Send a note to privacy@listdmarket.com with the subject “Subprocessor change notifications”.
| Vendor | Purpose | Data shared | Region |
|---|---|---|---|
| Supabase | Postgres database, authentication, object storage | All user + listing + rental data at rest | US (AWS us-east-1) |
| Vercel | Web hosting and edge compute | All request logs, request IPs, geolocation edge routing | US (global edge network) |
| Stripe | Payment processing, Stripe Connect payouts, Stripe Identity KYC | Cardholder data, connected-account KYC data, Stripe Identity session IDs | US (primary) |
| Cloudflare | DNS, edge security, Turnstile bot detection on public form submissions | IP, User-Agent, signed challenge token on public form posts | US (global anycast) |
| Resend | Transactional email delivery | Recipient email, message subject and body, delivery/bounce events | US |
| Twilio | SMS text message delivery (verification codes, rental alerts) | Phone number, message body, delivery status | US |
| OpenAI | AI-assisted listing descriptions and image analysis | Only content you submit to those features (listing text, uploaded images) | US |
| PostHog | Product analytics (page views, feature-flag decisions, event funnels) | Event stream with anonymous device ID and, for logged-in users, an authenticated distinct_id | EU Cloud (Frankfurt) |
| Firebase Cloud Messaging | Push notification delivery on iOS and Android | Device token, notification payload envelope (not message contents) | US |
| Apple | Sign-In with Apple authentication | App bundle ID and Apple ID at authentication time | US |
| Discord | Internal operator alerting via webhooks | Anonymized event signals only (e.g., “new concierge request”, “listing published”). No user PII. | US |
| Slack | Internal operator alerting via webhooks | Anonymized event signals only. No user PII. | US |
Not listed here
- Google Play and other app-store platforms — only relevant when we ship on Android. We’ll add them when that goes live.
- Cloudflare R2 / other Cloudflare services beyond DNS + Turnstile — we don’t use them today.
Questions? Email privacy@listdmarket.com.