Subprocessors

This page identifies third-party service providers (“Subprocessors”) authorized by Sisyphus Ventures Pty Ltd (ACN 655 466 729), trading as Untitled UI® (ABN 65 655 466 729) (“Untitled UI”, “we”, “us”, or “our”), to Process Personal Data on behalf of customers in connection with:

• Untitled UI React
• Untitled UI Figma
• Untitled UI Icons‍
• Related services, infrastructure, repositories, APIs, authentication systems, support systems, and enterprise offerings (collectively, the “Services”).

This page forms part of and is incorporated by reference into our:

• Data Processing Addendum (DPA);
• Privacy Policy;
• License Agreement;
• Enterprise User License Agreement (EULA); and
• Related legal documentation.

What is a Subprocessor?

A Subprocessor is a third-party service provider engaged by Untitled UI to Process Personal Data on behalf of customers in connection with the operation and delivery of the Services.

Untitled UI conducts reasonable diligence before engaging Subprocessors and requires Subprocessors to maintain appropriate privacy, confidentiality, and security protections consistent with applicable legal obligations and the nature of the services provided.

Current Subprocessors

Below are the trusted third-party providers and infrastructure partners Untitled UI uses to securely operate, deliver, and support our products and services:

Supabase

• Purpose: Managed Postgres database, authentication, and backend infrastructure (runs on AWS)
• Data processed: Account and team-member email addresses, hashed API credentials, license/membership metadata, audit logs (including IP and approximate location)
• Primary processing region: United States

Vercel

• Purpose: Application hosting, serverless functions, and deployment
• Data processed: Infrastructure and request logs, IP addresses, usage metadata
• Primary processing region: United States (primary); edge processing may occur globally

Cloudflare

• Purpose: CDN and edge security
• Data processed: IP addresses, request metadata
• Primary processing region: Global (edge)

GitHub

• Purpose: Source code repository hosting and customer repository access
• Data processed: GitHub usernames, repository access metadata
• Primary processing region: United States

Resend

• Purpose: Transactional and authentication email delivery
• Data processed: Email addresses and email delivery metadata
• Primary processing region: United States

Google (Generative AI — Gemini)

• Purpose: Embeddings for optional semantic component search
• Data processed: Search query text only (no account or stored personal data)
• Primary processing region: United States

Google Analytics

• Purpose: Website usage analytics
• Data processed: Usage metadata, device and browser metadata, IP-derived data
• Primary processing region: United States

Vercel Analytics

• Purpose: Privacy-friendly website analytics
• Data processed: Aggregated usage metadata
• Primary processing region: United States

Note on infrastructure:‍ Untitled UI does not contract with Amazon Web Services (AWS) directly. AWS is the underlying cloud infrastructure on which our managed providers Supabase and Vercel operate.

Independent Controllers (Not Subprocessors)

Certain third-party providers related to the Services act as independent Controllers rather than Subprocessors because they independently determine the purposes and means of Processing Personal Data.

These providers are not acting on behalf of Untitled UI and are governed by their own privacy policies, legal terms, and data processing agreements.

Polar.sh

• Purpose: Merchant of Record, payment processing, invoicing, tax/VAT/GST compliance, fraud prevention, and financial transaction processing

Polar’s Data Processing Addendum is available at Polar Data Processing Addendum.

Untitled UI does not directly collect, process, transmit, or store:

• Payment card information;
• Bank account information; or
• Regulated payment authentication data.

All payment-related processing is handled exclusively by Polar as Merchant of Record.

International Data Transfers

Some Subprocessors may Process Personal Data in jurisdictions outside the country in which Customer or its users are located.

Where required under applicable privacy and data protection laws, Untitled UI implements appropriate safeguards for international data transfers, including contractual and organizational protections designed to comply with applicable legal requirements.

Subprocessor Updates

Untitled UI may update this Subprocessors page from time to time to reflect operational, infrastructure, security, or service-related changes.

Continued use of the Services following the publication of an updated Subprocessors list constitutes acknowledgment of such updates where permitted by applicable law and contractual agreement.

Security and Due Diligence

Untitled UI undertakes reasonable diligence before engaging Subprocessors and seeks to ensure that Subprocessors maintain appropriate safeguards relating to:

• Confidentiality;
• Security;
• Access controls; and
• Protection of Personal Data.

Untitled UI does not guarantee or warrant the independent compliance status, certifications, or security posture of third-party providers.

Untitled UI

Untitled UI® (ABN 65 655 466 729) is operated by Sisyphus Ventures Pty Ltd (ACN 655 466 729), based in Melbourne, Australia.

If you have any questions regarding this Subprocessors page or Untitled UI’s privacy and data protection practices, please get in touch with our friendly team via [email protected].