Orgacha Subprocessor List

1 Active service providers

Replit Inc

Purpose. Application hosting, deployment, managed infrastructure, operational logging, Replit deployment analytics and the gateway for Replit AI Integrations.

Data involved. Account and organisation data, workplace content, uploaded files, configuration, network and device data, and technical logs.

Status, location and safeguards. Active. Orgacha contracts with Replit, Inc. under the Pro Agreement and its incorporated Data Processing Agreement. Published application infrastructure: North America. Replit’s DPA provides for international-transfer safeguards, including UK transfer instruments where applicable. The particular mechanism and any required assessment for Orgacha’s processing must be recorded. Support, development and downstream processing may involve other locations.

Neon or its applicable Databricks entity

Purpose. Managed PostgreSQL database infrastructure used through the Replit service.

Data involved. Account, organisation, workplace content, activity, permissions, configuration and database recovery data.

Status, location and safeguards. Active downstream database service through Replit. The database’s physical region and current downstream provider chain have not been independently confirmed. Configured point-in-time recovery is seven days. Scheduled daily backups are off and none are listed. These settings do not establish a physical-deletion deadline for every retained copy. Replit’s Pro DPA applies to its processing of customer personal data for the services, with downstream obligations governed by that agreement.

Google Cloud provider used by Replit

Purpose. Underlying object-storage infrastructure for Replit App Storage.

Data involved. Uploaded files, images, object identifiers and associated technical metadata.

Status, location and safeguards. Active downstream service through Replit. The existing bucket’s physical location remains unverified and has been referred to Replit Support. A bucket created before publication may differ from the published Project geography and is not relocated by publication. The underlying provider’s published backup-deletion cycle may take approximately 180 days after deletion from active systems. The specific storage transfer arrangements must be recorded.

OpenAI provider used through Replit AI Integrations

Purpose. Generates translations requested through Orgacha. Replit supplies the gateway and managed credentials.

Data involved. Selected post, comment, update, training or private-message text; target language; and limited request metadata. Attachments are not sent for translation.

Status, location and safeguards. Optional. Translation is currently disabled at organisation level. The configured model is gpt-5-mini through Replit-managed OpenAI credentials. Requests may proceed only when the required organisation and user controls permit them. Project geography does not apply to AI model requests. The provider-specific processing location, retention and applicable contractual and transfer arrangements remain to be established before enabling translation for live customer data.

Resend Inc

Purpose. Delivery of operational and transactional email.

Data involved. Recipient email address, display name, operational email content, delivery status and related technical metadata.

Status location and safeguards. Active. Processing may occur in the United States and in locations used by Resend’s downstream providers. Orgacha must retain the applicable DPA and restricted-transfer terms.

Stripe group entity applicable to the Orgacha account

Purpose. Payment collection, subscription administration, fraud prevention and billing support.

Data involved. Billing contact details, customer and subscription identifiers, transaction data and payment metadata. Payment-card details are submitted directly to Stripe and are not intended to be stored by Orgacha.

Status location and safeguards. Active for paid subscriptions. Stripe may act as processor for some services and as an independent controller for regulatory, fraud-prevention and payment-network purposes. Processing locations and safeguards are governed by the Stripe terms applying to the Orgacha account.

2 Customer enabled external services

A Customer may choose to connect Orgacha to an external workplace service. Where the Customer contracts with that provider and directs the connection, the provider may be the Customer’s processor or an independent recipient rather than an Orgacha subprocessor. The Customer is responsible for assessing and enabling the connection lawfully.

Planday is the currently identified optional workforce integration. When enabled by a Customer, employee profile, department, location and synchronisation metadata selected by that Customer may be exchanged with Planday. Orgacha will treat Planday as a subprocessor only where Orgacha, rather than the Customer, contracts with and instructs Planday to process Customer Personal Data on Orgacha’s behalf.

3 Analytics provider

Google Analytics is active as an optional analytics provider on Orgacha’s public website. It must not load or set analytics storage unless the visitor has accepted analytics cookies through Orgacha’s consent control. Signed-in workplace pages are not tracked by Google Analytics.

The applicable Google entity provides audience measurement and usage analytics. Data may include a pseudonymous browser identifier, page and session information, referral source, device information, approximate location and consent state. Orgacha must not intentionally send names, work email addresses, private messages, workplace post content or other direct identifiers to Google Analytics.

Google may process analytics data in the United States and other locations used by its group and subprocessors. The terms applying to the Orgacha Google Analytics property, including any UK restricted-transfer safeguard, must be retained and kept under review. Google may also act as an independent controller for limited purposes described in its own terms.

4 International transfers

Where Customer Personal Data protected by UK data-protection law is transferred to a country not covered by UK adequacy regulations, Orgacha will use the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another valid safeguard, together with any supplementary measures required by the circumstances.

A reference to a safeguard in this list does not replace the need to ensure that the relevant agreement has actually been accepted for the Orgacha account and covers the configured service. Orgacha will maintain copies or reliable records of the applicable provider terms.

5 Changes and objections

Orgacha will give the Customer reasonable advance notice of a new subprocessor where required by the Data Processing Addendum. The notice may be given by email, through the Service or by publishing an updated list and notifying affected Customers.

A Customer may raise a reasonable, documented data-protection objection by contacting info@orgacha.com within the period stated in the Data Processing Addendum. Orgacha will work in good faith to address the concern. If no reasonable solution is available, the remedies in the Agreement will apply.

6 Contact

Questions about subprocessors or transfer arrangements may be sent to info@orgacha.com. Orgacha Ltd, a company registered in England and Wales with company number 17486898 whose registered office is at 66 Paul Street, London EC2A 4NA.