Service providers

Plus Ultra Innovations Pty Ltd
ABN: 23 686 310 850

Version: 1.7
Last Updated: 8 October 2026

Changelog

• 8 Oct 2026 (v1.7): Upstash (Platform) now states that joining with a join code counts claims against the IP address used, kept for about 2 hours.
• 8 Oct 2026 (v1.6): Upstash (Platform) now states that the sign-in and password-reset limits count attempts against the email address and IP address used, kept for about 30 minutes, and that rate-limit analytics were switched off, and their records deleted, on 7 October 2026.
• 30 Sep 2026 (v1.5): rebuilt from measured facts and retitled "Service providers". Removed Anthropic and Sentry (the platform does not use them) and GitHub (it holds no personal information). Resend's sending region is Tokyo, Japan. Vercel is stated as processing in Sydney, Australia. Supabase is stated as Sydney only. Upstash is stated as Sydney. Added Slack, Microsoft, Google, Stripe and ImprovMX. Removed the per-provider security certifications and the provider requirements list, which had not been established for this document.
• 25 Sep 2026 (v1.4): the objection contact (Subprocessor Change Notification) is now privacy@plusultrainnovations.com.
• 25 Sep 2026: the privacy contact email is now privacy@plusultrainnovations.com (Contact).
• 22 Sep 2026: removed statements that had not been established (data processing agreements, Data Protection Officer).
• 29 January 2026: v1.1.

Overview

This page lists the third-party service providers that handle information on our behalf for the Wellbeing Dashboard platform and for our public website. For each provider it states what the provider does for us, what information it handles, and where. A location marked "to be confirmed" has not yet been confirmed.

Platform

Supabase Inc.
What it does: database hosting and sign-in.
Information: all platform data, including accounts, questionnaire answers, team structures and sign-in credentials (passwords are stored hashed).
Location: Sydney, Australia.

Vercel Inc.
What it does: hosts the application and runs its server functions.
Information: requests to the platform, including the IP addresses recorded in request logs.
Location: server functions run in Sydney, Australia. Vercel Inc. is a United States company.

Resend Inc.
What it does: sends the platform's emails (invitations, sign-in links, reminders and notices).
Information: the recipient's email address and the content of the email.
Location: sending region Tokyo, Japan.

Upstash
What it does: rate limiting, so that no account can make too many requests and no one can make too many attempts to sign in or reset a password.
Information: request counters keyed by a person's platform account identifier. For signing in and resetting a password, counters keyed by the email address and the IP address of each attempt, kept for about 30 minutes. For joining with a join code, a counter keyed by the IP address of each claim, kept for about 2 hours. Rate-limit analytics were switched off, and their records deleted, on 7 October 2026.
Location: Sydney, Australia.

Stripe
What it does: billing for organisations that subscribe.
Information: the email address of the administrator who sets up billing, and the organisation's name and platform identifier.
Location: to be confirmed.

Only when an organisation connects them

An organisation can choose to send notifications through its own Slack, Microsoft Teams or Google Chat workspace. These providers handle information only for organisations that connect them.

Slack
What it does: delivers notifications to the organisation's Slack workspace.
Information: a person's work email address (to find their Slack account) and the notification message.
Location: to be confirmed.

Microsoft (Teams, through Microsoft Graph)
What it does: delivers notifications to the organisation's Microsoft Teams.
Information: a person's work email address (to find their Teams account) and the notification message.
Location: to be confirmed.

Google (Google Chat)
What it does: delivers notifications to the organisation's Google Chat.
Information: the notification message, which can include the person's name.
Location: to be confirmed.

A safety alert sent through any of these providers does not include the worker's name.

Website and email

Vercel Inc. hosts the public website at www.plusultrainnovations.com; its server functions run in Sydney, Australia.

Resend Inc. sends website enquiries to our company inbox from Tokyo, Japan.

Google (company email) holds our company inbox, which receives website enquiries and email sent to our privacy address. Storage location: to be confirmed.

Upstash holds a website visitor's IP address as a rate-limit counter in Sydney, Australia, for up to 121 seconds.

ImprovMX forwards email sent to privacy@plusultrainnovations.com to our company inbox. Location: to be confirmed.

Changes to this list

We update this page whenever a provider is added, removed or changes what it handles for us, and record the change in the changelog above.

We will provide at least 30 days' notice before engaging a new service provider that handles personal information. Notice will be given by:

1. Email to the designated customer contact
2. An update to this page
3. A notice in the customer portal (for enterprise clients)

If you have concerns about a new service provider:

1. Contact privacy@plusultrainnovations.com within 14 days of the notice
2. We will discuss your concerns and possible alternatives
3. If the concerns cannot be resolved, you may end the affected services

Contact

For questions about our service providers:

Privacy contact
Plus Ultra Innovations Pty Ltd
ABN: 23 686 310 850
Email: privacy@plusultrainnovations.com