Subprocessors and Third-Party Services

Last Updated: 1 August 2026

1. Scope

This page identifies third-party service providers confirmed from the current production Website implementation. It is intended to help visitors understand which provider may receive Website-related personal data and why.

This register does not automatically apply to every Client project. Services used for a particular Client engagement are identified in the applicable proposal, Statement of Work, Data Processing Addendum or other written agreement where required.

2. Current Website Provider

Provider	Service and purpose	Website data that may be processed	Location and infrastructure
Vercel Inc.	Hosting, deployment, content delivery, server runtime, security and operational logging for the Website	Network and request data such as IP address, request headers, requested URL, date and time, device or browser information made available in an HTTP request, and technical logs needed to deliver, secure and troubleshoot the Website	The Website configuration requests the Singapore serverless-function region (sin1). Content delivery, security, support and other provider operations may use Vercel's global infrastructure and its own subprocessors. A configured region does not mean that all data remains exclusively in Singapore.

The current Website source does not implement visitor analytics, advertising pixels, newsletter software, Cloudflare Turnstile, Supabase, Uploadcare or Resend. Those services are therefore not presented as current Website subprocessors.

3. Forms and Communications

The Website may provide links or interface elements that allow a visitor to contact Hoslift. This register does not claim that enquiry content, uploaded files or transactional email are processed by any provider unless that processing is implemented and the relevant provider is added to this page.

If a visitor chooses to communicate through an external email, telephone, social-media or messaging service, that service may process the communication under its own terms and privacy notice. Such a service is not acting as a Hoslift subprocessor merely because the visitor chooses to use it.

4. Roles

For personal data processed through operation of the Website, Hoslift generally determines the purposes and means of processing and acts as controller. A provider acts as a processor only to the extent that it processes personal data on Hoslift's documented instructions. A provider may separately act as an independent controller for data it processes for its own account administration, security, fraud prevention or legal-compliance purposes.

Roles for Client projects depend on the relevant service and are stated in the applicable contract or Data Processing Addendum.

5. Provider Assessment and Safeguards

Before Hoslift introduces a provider that will process personal data on its behalf, Hoslift will assess the provider and the intended processing in proportion to the nature, sensitivity and risk of the data. Appropriate contractual, access-control, security, retention and international-transfer measures will be used where required by applicable law and the relevant agreement.

This statement does not represent that any particular data-processing agreement, certification, transfer mechanism or data-residency commitment applies unless it has actually been agreed for the relevant service.

6. Changes to This Register

Hoslift will update this page when a provider is added, removed or materially changes its role in the Website. Where a Client agreement requires advance notice of a new subprocessor, notice and any objection process will be handled under that agreement.

7. Questions and Objections

Questions about this register or the processing of personal data may be sent to hello@hoslift.com or submitted through the Contact page.

A Client wishing to object to a project subprocessor should use the procedure and time limit stated in the applicable Data Processing Addendum or other written agreement.