SEARCH & RESCUE
Service Provider Directory
Last verified: October 26, 2026
This directory describes providers used for our current website, merchant and test-marketplace workflows. Different providers receive different information, only for the relevant function. Listing a provider does not enable an optional feature or authorize access to an entire customer or boutique account.
Read it with our Customer Privacy Policy, Merchant Privacy Notice and Merchant Partner Agreement. It does not expand our permissions, permit advertising-data sales, or replace earlier commitments. Some providers act on our instructions for particular functions and also have independent responsibilities; this is not a representation that every provider is a processor for every purpose.
Review environment: Stripe payments/transfers and Uber delivery dispatch are currently test/sandbox operations. That does not mean all data is fictional: account sign-ins, inquiry submissions, SMS, email and entered test contact details can involve real information. Live payments and deliveries require separate production activation.
Supabase
- Function
- Authentication, database, storage and backend functions for the website, merchant workflows and test marketplace.
- Relevant information
- Relevant account and login records, boutique applications, catalog and order records, delivery details, payment references, inquiry submissions and operational logs. Full card details are handled by Stripe, not stored as marketplace card records.
- Processing locations
- The current development/review database is in North Virginia, United States (us-east-1). This is not a promise that every related operation stays there: edge delivery, telemetry and support can involve other locations, as explained by Supabase.
Render
- Function
- Hosting the public website, Shopify merchant application, founder portal and boutique-order pages.
- Relevant information
- Web requests, IP/device information, necessary application/session data and operational logs; form submissions while being passed to the database. Hosting a page does not authorize unrelated use of its content.
- Processing locations
- The public website's application server is in Oregon, United States. Other application services use their configured Render regions; network delivery, support and provider operations may involve other countries. The server location is not a guarantee of U.S.-only processing.
Stripe
- Function
- Payment processing, connected-boutique onboarding, transfers, payment security and necessary refunds/disputes. Current review checkout and transfers are test-mode only.
- Relevant information
- Transaction and payment-method information, business and connected-account references, and verification/bank details submitted directly to Stripe. S&R receives the permitted status and references needed for its role.
- Processing locations
- International processing, including the United States and India, as described by Stripe. Stripe and payment networks also have their own compliance responsibilities.
Shopify
- Function
- The merchant-authorized Shopify connection: store installation, catalog and inventory synchronization, and S&R-related order records.
- Relevant information
- Authorized shop, product, variant, stock, location and S&R order identifiers. The current routine S&R order-sync payload does not add the shopper's name, address, email, phone or card number. Privacy-request messages may separately contain necessary identifiers.
- Processing locations
- Canada, the United States and other locations used by Shopify and its service providers. The boutique's own Shopify service is also governed by Shopify's terms and privacy notices.
Uber Direct
- Function
- Delivery quotes, courier dispatch after boutique readiness, delivery tracking and support. The review flow uses sandbox delivery; pickup orders skip courier dispatch.
- Relevant information
- Necessary pickup/drop-off addresses and coordinates, contact details, instructions, package details, delivery status and verification records. A sandbox can still receive the real contact or address information entered for a test.
- Processing locations
- United States servers and global processing/support, as described by Uber. Involved couriers receive information needed for their assigned delivery; the MVP does not offer routine return transport.
Twilio
- Function
- Authorized operational SMS, including boutique order notifications and action links.
- Relevant information
- Sender/recipient phone numbers, necessary message content, message delivery/status records and related consent or suppression information. SMS also passes through telecommunications carriers.
- Processing locations
- United States and other locations used for communications routing, support and subprocessors. A recipient's country does not determine all processing locations.
Resend
- Function
- Transactional email, including boutique order notifications and account-related messages where configured.
- Relevant information
- Recipient email address, necessary message content and links, sending/delivery metadata and relevant suppression information. The recipient's email provider also handles the delivered message.
- Processing locations
- Resend lists U.S.-located subprocessors for hosting, email sending and related operations. Message delivery can involve the recipient's provider in another country; this is not an exclusive-residency guarantee.
OpenAI
- Function
- Permitted catalog enrichment, AI-assisted product search and requested Scout styling features.
- Relevant information
- Relevant authorized product text/images and requested search/styling inputs. Private bank details, identity documents and exact delivery addresses are not intentionally included. The privacy notices' consent and private-content restrictions continue to apply.
- Processing locations
- The integration uses OpenAI's global API endpoint, not a region-specific endpoint. No single-country residency or zero-retention guarantee is made. OpenAI's API documentation describes provider retention and regional controls; API content is not used for model training by default unless the API customer opts in. S&R's commitment not to use or authorize private Scout content for general-purpose model training remains unchanged.
- Function
- Company support email, optional Google sign-in where offered, and web fonts on pages that load Google Fonts.
- Relevant information
- Messages and attachments sent to company inboxes; sign-in identifiers and permitted profile information when Google sign-in is selected; request/IP/browser information when a browser loads a font. These functions do not grant S&R access to a user's Gmail or Drive.
- Processing locations
- Google operates servers worldwide; processing can occur outside the user's country. Each function follows its applicable Google service terms and settings.
Apple — TestFlight
- Function
- Distribution and testing of the iOS beta app. This entry applies to beta testers, not every boutique or website visitor.
- Relevant information
- Beta installation, device, usage and crash information and submitted feedback; invitation contact information where applicable. Apple shares permitted testing records with S&R. A public-link tester's name/email is not displayed to S&R merely because they joined that link.
- Processing locations
- Apple's international infrastructure and service providers under its privacy policy; TestFlight is not a U.S.-only processing commitment.
Changes and questions
The locations above describe verified configuration where stated and providers' published processing practices, not an exhaustive list of every support or network location. Provider links give further details and may change. We will update this directory for material changes to our own service use and follow the applicable notice, permission and merchant objection process before new processing begins. Updating this page alone does not override that process.
Lovable Cloud no longer serves the current public website or inquiry forms. A reference to Square or another possible commerce connection in a broader policy does not mean it is enabled in the Shopify review flow; any new connection must be documented with the applicable notices before use.
For privacy questions, information about an applicable provider or a merchant data-protection objection, email support@searchrescueapp.com. Do not include passwords, full card details or unnecessary identity documents.