Reading time: A few minutes. Plain summary: Current list of third-party subprocessors used by the Flathead Valley Directory.
1. Summary
Granite Ridge Realty uses a small number of third-party service providers (subprocessors) to deliver the Flathead Valley Directory. Each subprocessor is bound by its own privacy and security commitments and processes information only to provide its specific function. This page is updated when subprocessors change.
2. Current Subprocessors
The following subprocessors process personal data on behalf of Granite Ridge Realty:
Supabase, Inc. Location: United States. Function: database, authentication, file storage. Data processed: all account information, business listings, photos, messages, claims, contact events, legal acceptances.
Netlify, Inc. Location: United States. Function: web hosting and static asset delivery. Data processed: standard HTTP server logs including IP address, user agent, and referrer URL.
Resend Inc. Location: United States. Function: transactional email delivery. Data processed: recipient email address, sender name and contact information (when applicable), email subject and body content.
OpenStreetMap Foundation. Location: United Kingdom. Function: one-time geocoding at listing submission (Nominatim) and ongoing map tile rendering. Data processed: address text at submission time; visitor IP and user agent for tile requests.
3. Third-Party Network Assets
The directory also loads assets from third-party networks. These are not subprocessors (they do not process personal data on our behalf), but they do see standard HTTP request metadata when assets load:
Google Fonts (fonts.googleapis.com, fonts.gstatic.com): serves the Sora and Outfit typefaces.
jsDelivr (cdn.jsdelivr.net): delivers the Supabase JavaScript client library and the Cropper.js library used on the submission form.
YouTube (www.youtube-nocookie.com): loads embedded videos when a business listing includes them, using YouTube's privacy-enhanced no-cookie domain. The video player does not set tracking cookies until the user clicks play.
Vimeo (player.vimeo.com): loads embedded videos when a business listing includes them.
4. Changes to This List
If we add a new subprocessor that processes personal data, we will update this list and note the change in our Privacy Policy effective date. We will notify account holders by email where reasonably possible before the change takes effect.