Last updated: 28 September 2026
When you use Dinopix, you are the controller of your customers' personal information and we process it on your behalf. To do that we rely on the third-party services below. This page lists every one of them that can process personal information, what it is used for, and where it runs.
Our primary database and its backups are in Singapore, not Australia. We would rather say that plainly here than have you find it out later. Because personal information is disclosed to overseas recipients, APP 8 of the Privacy Act 1988 (Cth) applies, and we take reasonable steps, including contractual data processing terms with each provider below, to ensure they handle it consistently with the Australian Privacy Principles. Transfers of European or UK personal data are made under the European Commission's Standard Contractual Clauses.
These run the product itself. Your data is stored and processed here.
| Service | What we use it for | Data involved | Region |
|---|---|---|---|
| Supabase (AWS) | Primary database, authentication, file storage and serverless functions | Account details, and the review, message and CRM data you hold in Dinopix | Singapore (ap-southeast-1), including daily encrypted backups |
| Railway | Background synchronisation worker and scheduled jobs | Review, comment and message data in transit during a sync | Singapore (Southeast Asia) |
| Netlify | Hosting for our website and web application | Request metadata such as IP address and user agent | Global content delivery network |
| Cloudflare | DNS, and routing for inbound review notification email | Request metadata, and inbound email in transit | Global network |
These deliver specific functions on our instruction.
| Service | What we use it for | Data involved | Region |
|---|---|---|---|
| Brevo | Transactional and marketing email delivery | Recipient name and email address, and message content | European Union (France) |
| Stripe | Subscription billing and payment processing | Billing contact details and payment metadata. Card numbers are handled by Stripe and never reach Dinopix | United States and global |
| Anthropic | AI-drafted review replies and sentiment analysis | Review and comment text submitted for analysis. Not used to train models | United States |
These are the sources you choose to connect. Where a platform allows it, data flows both ways: we read reviews and messages from it, and post your replies back. ProductReview and Trustpilot reach us by forwarded email, and replies to them are posted by you.
| Service | What we use it for | Data involved | Region |
|---|---|---|---|
| Google Business Profile reviews, sign-in, spam protection (reCAPTCHA Enterprise), and website analytics | Review content and reviewer names, account identifiers, and website usage data | United States and global | |
| Meta | Facebook and Instagram reviews, comments and messages | Review and comment content, commenter names and profile identifiers | United States and global |
| Judge.me | Product reviews from your online store, and publishing your replies to them | Review content, reviewer display names and the product reviewed. Reviewer email and IP address are received but not stored | United Kingdom and United States |
| TikTok | Comments on your TikTok videos, and publishing your replies and hide actions | Comment content, commenter usernames and display names, and your video captions and links. Commenter profile pictures are received but not stored | United States and global |
| ProductReview.com.au | Review notification emails you forward to Dinopix | Review content and reviewer names, extracted from the forwarded email | None: email arrives from ProductReview, and we send it no data |
| Trustpilot | Review notification emails you forward to Dinopix, and verified review invitations if you turn them on | Review content and reviewer names from forwarded emails. For invitations: your customer's name, email address and an order reference | European Union and global |
This list covers the services that can process personal information. Tools we use only to build and run our own marketing website, such as content authoring and image hosting, are not listed, because no customer personal information reaches them. If that ever changes, they get added here.
We will update this page before a new sub-processor begins handling customer personal information, and we will give customers on paid plans at least 30 days' notice by email of any addition. If you object to a new sub-processor within that period, contact us. if we cannot resolve it, you may cancel your subscription without penalty for the remainder of the term.
Our standard Data Processing Agreement sets out the terms on which we process personal information on your behalf. It applies automatically to every paid plan and needs no separate signature. If your organisation requires a countersigned copy or your own paper, get in touch through our contact page.
See our Privacy Policy for how we handle personal information generally, or contact us with anything this page does not answer.