This Vendor and Subprocessor Disclosure lists the third-party vendors and subprocessors used by My Waypoint Technologies Inc. in connection with our products and services, what data they access, and what safeguards are in place.
We require service providers to protect personal information and use it only for authorized purposes.
This disclosure reflects our public Tier 1 vendor inventory. Detailed internal infrastructure inventories are maintained separately and are not publicly disclosed unless required by applicable law, regulatory obligation, or legal counsel.
2. What Is a Subprocessor
A subprocessor is a third-party service provider that processes personal information on our behalf in connection with our products and services. This includes cloud infrastructure providers, payment processors, email delivery services, and other vendors.
This disclosure covers vendors that may access or process personal information. It does not cover vendors that provide services without accessing personal information (such as domain registrars or DNS providers).
3. Vendor Summary
Vendor
Category
Processes Personal Information?
Primary Purpose
Amazon Web Services (AWS)
Infrastructure & Hosting
Yes
Cloud hosting and application services
Microsoft 365
Productivity & Communications
Yes
Email and collaboration
Microsoft Copilot
Artificial Intelligence
Limited Internal Use
Productivity assistance
GitHub
Source Control & Development
No Customer Personal Information
Source control and development
Stripe
Payments
Yes
Payment processing
Google Maps Platform
Mapping & Location Services
Limited
Address and location services
AWS Q Developer
Artificial Intelligence
Internal Use Only
Software development assistance
Self-Hosted AI Infrastructure
Artificial Intelligence
Internal Use Only
Locally operated AI models
4. Detailed Vendor Profiles
Amazon Web Services (AWS)
Infrastructure & Hosting
Purpose
Cloud infrastructure, hosting, and related services for all MyWaypoint products.
Information Processed
Contact form submissions (name, email, message); application data for hosted products.
Location
AWS regions currently in use include Canada (ca‑central‑1) and US East (us‑east‑2 — Ohio). Certain services may operate using infrastructure located in Canada and/or the United States. Canadian data residency is not guaranteed unless explicitly stated within a customer contract or service agreement. See Cross-Border Processing below.
Products Affected
All products.
Safeguards
The AWS Customer Agreement incorporates the AWS Data Processing Addendum (DPA), which governs the processing of personal data by AWS on behalf of customers. The AWS DPA includes contractual commitments regarding data processing purposes, security measures, sub-processor management, and data subject rights assistance. For transfers of personal data to the United States, the AWS DPA incorporates Standard Contractual Clauses (SCCs) as a transfer mechanism. AWS maintains ISO 27001, SOC 1, SOC 2, and SOC 3 certifications. AWS publishes transparency reports and law enforcement guidelines at aws.amazon.com/compliance/.
Microsoft 365
Productivity & Communications
Purpose
Email, productivity, and collaboration services.
Information Processed
Business communications and internal documents.
Location
Microsoft data centres (may include cross-border processing). See Cross-Border Processing below.
Products Affected
Internal operations.
Safeguards
Microsoft Data Processing Agreement; Microsoft Privacy Policy. Microsoft 365 is covered by the Microsoft Products and Services Data Protection Addendum (DPA), which includes Standard Contractual Clauses (SCCs) for cross-border transfers.
Microsoft Copilot
Artificial Intelligence
Purpose
AI productivity assistance.
Information Processed
Internal use only — no customer personal information is automatically shared.
Location
Microsoft data centres.
Products Affected
Internal operations.
Safeguards
Microsoft Data Processing Agreement; Microsoft Privacy Policy. Covered by the Microsoft Products and Services DPA.
GitHub
Source Control & Development
Purpose
Source code hosting and version control.
Information Processed
Source code only — no customer personal information.
Location
United States.
Products Affected
All products (development).
Safeguards
GitHub Privacy Policy; GitHub Data Protection Agreement.
Stripe
Payments
Purpose
Payment processing.
Information Processed
Billing name, billing address, and payment card details (processed directly by Stripe).
Location
Stripe processes payments globally. Canadian customer data may be processed in the United States or other jurisdictions where Stripe operates. See Cross-Border Processing below.
Products Affected
MyCleanData.
Safeguards
Stripe Data Processing Agreement (DPA), available at stripe.com/legal/dpa, governs Stripe's processing of personal data on behalf of merchants. The Stripe DPA incorporates Standard Contractual Clauses (SCCs) for cross-border transfers of personal data from the European Economic Area, United Kingdom, and Switzerland; Stripe applies equivalent transfer protections for Canadian personal data transferred to the United States. Stripe is certified as a PCI DSS Level 1 Service Provider. Stripe publishes transparency reports at stripe.com/legal/transparency.
Google Maps Platform
Mapping & Location Services
Purpose
Mapping and location services.
Information Processed
Address and location queries.
Location
Google data centres (may include cross-border processing). See Cross-Border Processing below.
Products Affected
MyDataTools (Address Geocoder).
Safeguards
Google Maps Platform Terms of Service; Google Privacy Policy; Google Cloud Data Processing Addendum.
AWS Q Developer
Artificial Intelligence
Purpose
AI-assisted software development.
Information Processed
Internal development use only — no customer personal information is automatically shared.
Location
Amazon Web Services infrastructure.
Products Affected
Internal operations.
Safeguards
AWS Service Terms; AWS Privacy Notice; AWS DPA (as described in the AWS profile above).
Self-Hosted AI Infrastructure
Artificial Intelligence
Purpose
Locally operated AI models, including LM Studio, Mission Control, Qwen, DeepSeek, and other models operated by My Waypoint Technologies Inc.
Information Processed
Internal use only. Some AI workloads may be processed on self-hosted systems operated and controlled by My Waypoint Technologies Inc.
Location
Systems operated by My Waypoint Technologies Inc.
Products Affected
Internal operations.
Safeguards
Operated and controlled by My Waypoint Technologies Inc.
5. Cross-Border Processing
Some service providers used by My Waypoint Technologies Inc. operate infrastructure in Canada, the United States, and other jurisdictions. As a result, personal information may be transferred to and processed outside of Canada.
When personal information is processed in another jurisdiction, it may become subject to the laws of that jurisdiction. We remain responsible for protecting personal information in accordance with applicable Canadian privacy laws and require service providers to implement appropriate safeguards.
Unless explicitly stated in a customer agreement, Canadian data residency is not guaranteed.
6. How We Assess Vendors
We evaluate service providers based on business, security, reliability, and operational needs. We require service providers to protect personal information and use it only for authorized purposes.
Vendor contractual and privacy requirements are reviewed as part of our governance processes. Contractual requirements are documented in internal governance records.
7. Notification of Changes
We will update this disclosure when we add, remove, or materially change a vendor that processes personal information. Changes will be reflected in the Policy Change Log.