Sub-processors
Last updated: 14 June 2026
Massageasy uses a small number of trusted service providers to run the Service. Each is a “sub-processor” under the Thai Personal Data Protection Act (PDPA) when it handles personal data on our behalf. This page lists them and what they do.
We will give venues at least 30 days’ notice before adding a new sub-processor. The notice is posted on this page and announced to account owners by email. See our Terms of Service section 4a (Data Processing) for the controller-processor terms.
Current sub-processors
| Provider | Purpose | Data processed | Location | Privacy policy |
|---|---|---|---|---|
| Supabase | Managed Postgres database and authentication. | Venue accounts, settings, session records, intake data, feedback, billing status. | Tokyo, Japan (ap-northeast-1). | supabase.com/privacy |
| Vercel | Application hosting and serverless functions (Massageasy web app and API). | Standard server logs (IP, timestamps), authentication cookies. | United States (primary) + global edge network. | vercel.com/legal/privacy-policy |
| Resend | Transactional email delivery (signup confirmation, password reset, trial reminders). | Recipient email address, subject, message body, delivery status. | United States. | resend.com/legal/privacy-policy |
| ImprovMX | Inbound email forwarding for the hello@massageasy.com address. | Email envelope and content for messages sent to addresses at our domain. | United States. | improvmx.com/privacy |
Payments
Massageasy does not process card payments. Guests pay venues directly using each venue’s own payment method (cash, QR, card, hotel charge). For subscription billing of venue owners, payment provider details will be added here when card billing is enabled.
Changes
Material changes to this list are announced to account owners by email at least 30 days before they take effect. The date above reflects the last update.
Contact
Questions about sub-processors: massageasyapp@gmail.com.