1. Identified main-website services
| Provider / service | Purpose and information | Location and scope |
|---|---|---|
| Amazon Web Services - Simple Email Service | Delivery of website enquiries: sender, recipient, contact and business details, message content and submission information. | The website's default SMTP endpoint is the Australia (Sydney) region. This does not establish an Australia-only commitment for all provider operations, support or every TradePilot service. |
| Cloudflare - Turnstile | Bot protection for the enquiry form; connection and browser signals used by the challenge service. | Cloudflare operates internationally, including the United States. Consult its current Turnstile Privacy Addendum and Privacy Policy for its processing roles and locations. |
| Google - Google Fonts | Hosted typography; requests disclose technical connection information such as IP address. | Google operates internationally, including the United States. This is not an activation of Google Analytics or an advertising pixel. See Google's font privacy information. |
Website enquiry mail can also be retained in the receiving business mailbox and its hosting provider. Server configuration can override the website's default mail endpoint. Changes to the actual provider arrangements need to be reflected in the applicable notice.
2. Integrations selected by a customer
Xero: where a customer enables the accounting or payroll integration, permitted contact, invoice, expense, workforce, payroll and related records may be exchanged according to the configured scopes and actions. Xero's privacy notice identifies processing in countries including Australia, New Zealand and the United States. See Xero's Privacy Notice.
Customer-configured email and other services: an organisation's own SMTP server, accounting account or other enabled connection has its own provider and retention settings. A customer's independent provider is not automatically a TradePilot-appointed subprocessor.
Mobile delivery: where an app build uses a mobile wrapper, app store or notification provider, relevant device, distribution or notification processing depends on that build and its enabled features. Apple, Google or a wrapper provider is not described here as receiving every workspace record merely because an app can be installed.
3. Deployment-specific information
A complete processing assessment must also cover the actual application and database hosting; backups and recovery locations; SMS and email delivery; receipt or document extraction and any AI provider; mobile-wrapper and notification services; support access; and security or monitoring providers that receive personal information.
Those app-specific identities, processing locations, retention settings and contract arrangements are not established by the main-website configuration alone. Contact sales@tradepilot.com.au for the current information relevant to your account before relying on a complete subprocessor list, residency statement or restricted-transfer arrangement. A service that is not enabled need not receive your information.
Under the Data Processing Terms, TradePilot must disclose the providers relevant to instructed processing and give the applicable notice of changes. A website provider list is not itself a signed international-transfer mechanism or proof of every technical control.
4. Questions or data-protection objections
Contact sales@tradepilot.com.au with your company, the relevant feature and the information you need. Do not include unnecessary personal records. Existing customers can raise a reasonable data-protection objection to a notified subprocessor change through the process in the Data Processing Terms.
Read this page with the Privacy Policy and Cookies & Website Technology Notice.
TradePilot Pty Ltd · 2026-09-R1
Back to top ↑