Effective October 29, 2026
Subprocessors
Use this when Garvold hosts a customer's operational data. The customer decides what that data is for. Chef Nylah's LLC processes it on their instructions, which are: provide the workspace, keep one business's rows away from another's, and do not use the data to market to their clients or staff.
Instructions and roles
- The customer tells us what to store by using the product. We do not add a new use, and we do not train a model on it. There is no model in the product today.
- We are responsible for the people we allow to operate the platform, for the vendors below, and for telling the customer if we become aware of a breach of their workspace.
- The customer is responsible for having a reason to hold their clients' and staff's data, and for not typing data the product should not have.
Security
Garvold separates each business in the database, not only on the screen. Pages are served over HTTPS. We do not have a SOC 2 report, and we will not describe the product as certified. You can export your rows from the product. Receipt photos are not in that file today.
Who processes data for us
| Name | What for | Where |
|---|---|---|
| Supabase | Database, login, file storage, and application functions | Supabase infrastructure on Amazon Web Services. Data may be stored outside your country. |
| Vercel | Hosting the web pages | Vercel's edge network. That is not a statement of where the database is stored. |
| Resend | Invitation and application email, when email is turned on | If email is off, that mail is not sent. |
A material change to this list is sent to customers at least 30 days before the new vendor is used for their data. A shorter notice is used only when it is needed to protect the service, and we will say so.
Breach, requests, and deletion
- We tell the customer without undue delay after we confirm a breach of their data, and within 72 hours where a law requires that clock. That is the shape used by the Nigeria Data Protection Act and by the GDPR. Where the law requires us to notify a regulator, we do that. Where the law treats the customer as the one who must notify, we give the customer what we know in time for their clock.
- Security reports come to security@garvold.com. Privacy questions come to support@garvold.com.
- We help the customer answer an access or correction request about data we hold for them. The export is the starting point. We finish a closure within 30 days.
- On a written closure instruction, we delete or return the workspace within 30 days, except the records the privacy notice keeps. Deletion is a request to us, not a button.
International transfers
Data is hosted on Supabase, which runs on Amazon Web Services, and may be stored outside the customer's country, including for customers in Nigeria and the United States. Where a transfer needs a safeguard, we use an appropriate safeguard the applicable law recognizes, such as standard contractual clauses or another mechanism that covers that transfer.