Last updated: October 27, 2026 · Notice version: 2026-10-27
Isbell Group, LLC uses the providers below to operate Tarca. This list explains their functions and the information involved. A provider may be a processor, subprocessor or independent controller for different activities under applicable law and its contract. Listing a provider is not a claim that Tarca inherits that provider's certifications or has completed every possible compliance requirement.
Providers currently used in the Service
| Provider | Function | Information involved |
|---|---|---|
| Supabase | Database, account authentication, private attachment storage and server functions | Account records, authorized workspace content, permissions, files, workflow and security records |
| Vercel | Website/application hosting, document extraction and AI Gateway for optional AI processing | Technical request and hosting records; selected image-transcription inputs/outputs and, where enabled, selected meeting audio, transcripts, context and summary outputs. Meeting Notes requires routes configured for zero data retention and no prompt training |
| OpenAI | Optional note-image transcription; optional Meeting Notes summaries and grounding checks | Selected images for image import; selected meeting transcript, title/type and user-entered context/notes for Meeting Notes. Training is disallowed. Meeting Notes requires a zero-data-retention Gateway route; image import does not make that retention promise |
| Mistral AI | Optional Meeting Notes audio transcription and speaker segmentation, where enabled | Selected audio, meeting title, short user-supplied background terms and request metadata through the Gateway; returned transcript text, timestamps and speaker labels. Requests require a zero-data-retention Gateway route and no prompt training |
| Stripe | Hosted checkout, subscription management and billing portal when paid checkout is enabled | Payment details supplied directly to Stripe; billing identity/address, customer/subscription and invoice records, taxes, amounts and payment status. Tarca does not collect full card numbers in its application |
| Resend / Plus Five Five, Inc. | Account and deliberate workflow-email delivery | Recipient addresses, email content and delivery metadata; optional digest emails contain a generic Inbox link rather than private task/comment content |
| Twilio | Optional Text to task incoming SMS transport, phone linking and provider-managed STOP/START/HELP handling, where enabled | Sender/recipient phone numbers, user-sent linking codes and task texts, provider message identifiers and delivery/opt-out metadata. Participating carriers also process message traffic. Tarca sends no automatic linking, task or error replies and does not use this program for marketing |
| Cloudflare Turnstile | Abuse prevention on public intake forms | Browser, connection and origin signals and challenge verification; Tarca does not send form answers or contact records as verification inputs. Cloudflare also uses signals to improve bot detection under its Turnstile notice |
| Google Workspace | Business email and support, privacy, billing and legal correspondence | Sender/recipient addresses, message contents, attachments and delivery/account records associated with correspondence; no automatic copy of customer workspaces into email |
We also use GitHub for source control and deployment coordination. It is not the intended storage location for customer workspace content, credentials or support exports. A development tool is not automatically a recipient of production customer records.
Provider infrastructure and authorized support operations may involve processing in the United States and other countries. This list does not promise exclusive storage or access in one country. The actual hosting configuration and agreements must be assessed for any customer requiring a specific location.
For provider-specific information, see Supabase legal materials, Vercel legal materials, OpenAI business terms and policies, Mistral legal materials, Stripe privacy, Resend legal materials, Twilio privacy, Google Workspace terms, and Cloudflare Turnstile privacy information. Those sites describe each provider's own services; they do not replace Tarca's Privacy Notice or describe every feature we have enabled. A provider's list of possible subprocessors does not mean Tarca has enabled all of that provider's optional products.
Optional features and future providers
Stripe processing occurs only through an enabled checkout or an existing authorized billing relationship. Accepting account terms or redeeming a complimentary code does not authorize a purchase.
Text to task is optional and requires deliberate authorization to capture incoming texts, followed by proof that you control the phone. It does not enroll you in automatic task-confirmation texts. Twilio processes the requested messages; it does not receive your wider task list or workspace through this feature. Mobile numbers and SMS opt-in information are not sold or shared with third parties or affiliates for marketing or promotional purposes. Providers process them to operate the requested program, not to use Tarca consent for their own messaging. See Text to task details and the Privacy Notice for authorization, opt-out and retention details.
Optional image transcription and Meeting Notes process only the content selected for those features. Meeting Notes does not automatically scan linked contacts, companies, projects, tasks or the wider workspace. Its model-retention controls do not erase the notes saved in Tarca or ordinary security, billing and usage metadata. No general AI assistant or automatic AI workspace analysis is offered. A future integration may need additional providers, customer choices and an updated notice before activation.
Business data processing agreements
Business customers may need a data processing agreement based on their information, legal obligations and use of the Service. Contact Isbell Group at privacy@tarca.app or through Legal & contact before relying on a particular contractual commitment. An internal draft or this provider list is not an executed DPA, a business associate agreement, a data-transfer mechanism or an assurance that a regulated use is supported.
We will update this list when the Service's provider relationships change. If an executed agreement requires individual advance notice, objection rights or a specific replacement process, we must also follow that agreement; updating this page alone is not a substitute.