<?php
/**
 * Plattr — Sub-processor list.
 *
 * Public legal surface, served at /legal/sub-processors (nginx try_files
 * resolves /legal/sub-processors → this file via $uri.php; no router entry
 * needed). Referenced from the Data Processing Agreement clause of /terms.
 *
 * This is the authoritative, dated list of the third parties Plattr uses to
 * process personal information on behalf of its business customers. Keep it in
 * sync with the processor list in terms.php §5 (Privacy). When you add or
 * remove a sub-processor, update the "Last updated" date below and give
 * customers the notice period stated in the DPA.
 */
declare(strict_types=1);

$pageTitle = 'Sub-processors — Plattr';
$pageDesc  = 'The third-party providers Plattr uses to process personal information on behalf of its customers, and where each one operates.';
$pageSlug  = 'legal';

/* Edit this list — one row per sub-processor. Location = where the provider
 * may store or process data, which matters for overseas-transfer disclosure. */
$SUBPROCESSORS = [
    ['Amazon Web Services, Inc.', 'Cloud hosting, file storage and transactional email infrastructure (S3, SES).', 'Australia (Sydney) &amp; United States'],
    ['Cloudflare, Inc.',          'Content delivery network, DDoS protection and edge security / WAF.',              'Global edge network (US HQ)'],
    ['Stripe, Inc.',              'Payment processing and fraud prevention (PCI-DSS Level 1). Card data is tokenised and never stored by Plattr.', 'United States &amp; Ireland (EU)'],
    ['Hetzner Online GmbH / OVH', 'Server and database infrastructure.',                                            'Germany / European Union'],
    ['Google LLC',                'Website and product analytics (Google Analytics).',                              'Global (US HQ)'],
    ['Resend, Inc.',              'Transactional email delivery (receipts, password resets, alerts).',              'United States'],
    ['The Rocket Science Group (Mailchimp)', 'Marketing email delivery and campaign analytics.',                   'United States'],
    ['Migadu Email OÜ',           'Business mailbox and email routing.',                                            'Switzerland / European Union'],
    ['Twilio Segment',            'Customer data pipeline that routes product events to the tools above.',          'United States'],
];

$lastUpdated = 'Last updated 10 July 2026';

require __DIR__ . '/../includes/page-head.php';
?>

<style>
/* ═══ Sub-processors — editorial legal table ═════════════════════ */
.sp-hero{max-width:1000px;margin:0 auto;padding:56px 32px 22px}
.sp-eyebrow{
  display:inline-block;font-size:12px;font-weight:700;letter-spacing:.14em;
  text-transform:uppercase;color:var(--pb-brand-dim);margin:0 0 14px;
}
.sp-hero h1{
  font-family:'Playfair Display',Georgia,serif;font-weight:500;
  font-size:clamp(34px,5.4vw,54px);line-height:1.05;letter-spacing:-0.02em;
  margin:0 0 16px;color:var(--pb-ink);
}
.sp-hero p{font-size:15.5px;line-height:1.68;color:var(--pb-soft);max-width:70ch;margin:0 0 8px}
.sp-hero a{color:var(--pb-brand-dim);text-decoration:none;font-weight:500}
.sp-hero a:hover{text-decoration:underline}
.sp-updated{margin-top:14px;font-size:13px;color:var(--pb-muted);font-weight:600}

.sp-wrap{max-width:1000px;margin:0 auto;padding:14px 32px 96px}

.sp-tablecard{
  border:1px solid var(--pb-line,rgba(0,0,0,.08));border-radius:16px;overflow:hidden;
  background:var(--pb-card,#fff);box-shadow:0 1px 2px rgba(0,0,0,.04);
}
table.sp-table{width:100%;border-collapse:collapse;font-size:14px}
.sp-table th{
  text-align:left;font-size:11px;font-weight:700;letter-spacing:.1em;text-transform:uppercase;
  color:var(--pb-muted);padding:14px 18px;background:rgba(var(--pb-brand-rgb),0.04);
  border-bottom:1px solid var(--pb-line,rgba(0,0,0,.08));
}
.sp-table td{padding:15px 18px;border-bottom:1px solid var(--pb-line,rgba(0,0,0,.06));color:var(--pb-soft);line-height:1.55;vertical-align:top}
.sp-table tr:last-child td{border-bottom:none}
.sp-table td:first-child{color:var(--pb-ink);font-weight:600;white-space:nowrap}
.sp-table td:last-child{white-space:nowrap;color:var(--pb-ink)}

.sp-note{
  margin-top:26px;padding:18px 20px;border-radius:14px;
  background:rgba(var(--pb-brand-rgb),0.05);border:1px solid rgba(var(--pb-brand-rgb),0.14);
  font-size:14px;line-height:1.62;color:var(--pb-soft);
}
.sp-note strong{color:var(--pb-ink)}
.sp-back{display:inline-block;margin-top:26px;font-size:14px;color:var(--pb-brand-dim);text-decoration:none;font-weight:600}
.sp-back:hover{text-decoration:underline}

@media(max-width:720px){
  .sp-table td:first-child,.sp-table td:last-child{white-space:normal}
  .sp-hero,.sp-wrap{padding-left:20px;padding-right:20px}
}
</style>

<div class="sp-hero">
  <span class="sp-eyebrow">Legal</span>
  <h1>Sub-processors</h1>
  <p>A <strong>sub-processor</strong> is a third-party provider that Plattr uses to help deliver the Service, and which may handle personal information on our customers’ behalf — for example a hosting provider that stores data, or a payment processor that handles a transaction. Under the New Zealand Privacy Act 2020 you remain the agency responsible for your customers’ information; we handle it as your service provider, and these providers do so on our behalf under written agreements.</p>
  <p>Because Plattr serves businesses in New Zealand and internationally, some of these providers operate outside New Zealand. Where information is disclosed overseas we apply Information Privacy Principle 12 and, where the laws of the EU, UK or other regions apply, the transfer mechanisms those laws require. See our <a href="/terms#privacy">Privacy Policy</a> and <a href="/terms#priv-12">Data Processing Agreement</a> for detail.</p>
  <div class="sp-updated"><?= htmlspecialchars($lastUpdated) ?></div>
</div>

<div class="sp-wrap">
  <div class="sp-tablecard">
    <table class="sp-table">
      <thead>
        <tr><th>Provider</th><th>What they do for us</th><th>Where they process</th></tr>
      </thead>
      <tbody>
        <?php foreach ($SUBPROCESSORS as $sp): ?>
        <tr>
          <td><?= htmlspecialchars($sp[0]) ?></td>
          <td><?= $sp[1] ?></td>
          <td><?= $sp[2] ?></td>
        </tr>
        <?php endforeach; ?>
      </tbody>
    </table>
  </div>

  <div class="sp-note">
    <strong>Changes to this list.</strong> We keep this page current and will give notice of any new sub-processor before it starts handling your data, as set out in our Data Processing Agreement. Customers with an active DPA can request to be notified of changes by emailing <a href="mailto:hello@plattr.nz">hello@plattr.nz</a>. Where a provider offers several regional facilities, the location shown is where your data is most likely to be stored or processed; it is not necessarily the only one.
  </div>

  <a href="/terms#privacy" class="sp-back"><i class="bx bx-arrow-back"></i> Back to Terms &amp; Privacy</a>
</div>

<?php require __DIR__ . '/../includes/page-foot.php'; ?>
