Subprocessor List

1. Purpose of this list

When a customer uses Agripino, we process personal data on their behalf: that of their staff, their suppliers and their clients. In that relationship the customer is the data controller and Agripino is the processor. To deliver the service we rely on a small number of third parties, which act as subprocessors.

This list forms part of the Data Processing Agreement and is kept current. Any change is communicated at least 10 business days in advance, as described in section 5.

2. Our own infrastructure

This means your farm data, staff records and financial movements are stored in Costa Rica, on equipment we administer directly. There is no external cloud provider with access to that database.

We use PostgreSQL with Supabase in self-hosted mode. Supabase is open-source software that we run ourselves; Supabase Inc. plays no part in the processing and has no access to the data.

3. Current subprocessors

The following third parties take part in the processing. None is authorised to use the data for its own purposes.

4. International transfers

File storage and network transit involve transferring data outside Costa Rica. Pursuant to Chapter III of Law 8968, those transfers rest on the informed consent of the data subject and on contractual confidentiality and security commitments with the subprocessor.

The main database, which holds most of the farm, staff and financial information, remains in Costa Rica and is not transferred.

5. Changes to this list

Before adding a new subprocessor:

• We publish the change on this page and notify the customer by email at least 10 business days in advance.
• The customer has 30 calendar days to object in writing.
• If the objection is reasonable and we cannot offer an alternative, the customer may terminate the contract without penalty and with a pro-rata refund of the unused portion of the current cycle.

To receive these notifications or to consult the change history, write to [email protected].

6. What we do not use

For the avoidance of doubt, and because their absence matters as much as their presence, we record that Agripino does not use:

• Web analytics or behavioural tracking tools.
• Advertising networks or third-party pixels.
• Payment processors with access to platform data.
• Third-party SMS or mapping services.
• Third-party artificial intelligence services that receive user data.

If any of these are introduced in future, this list will be updated under the procedure in section 5 before they go into operation.