Legal
Subprocessors
Effective May 22, 2026
This page lists the third-party service providers (“Subprocessors”) that OrangeTree Technologies LLC d/b/a HangarOS uses to deliver the HangarOS platform (the “Service”). This page is incorporated into and forms part of our Data Processing Agreement.
We require each Subprocessor by contract to protect personal data and to use it only for the purpose for which we engage them.
How to subscribe to changes
We provide at least 30 days' notice before adding or replacing a Subprocessor. To receive notifications by email, subscribe at privacy@hangaros.com with the subject line “Subprocessor notifications.”
You may object to a new Subprocessor on reasonable data-protection grounds within 14 days of our notice. See Section 6 of the DPA.
Infrastructure Subprocessors
| Subprocessor | Purpose | Data processed | Location | Privacy / DPA |
|---|---|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting (Lambda, API Gateway), object storage (S3), database identity (Cognito), email delivery (SES), secrets management (Secrets Manager), logging (CloudTrail, CloudWatch) | All Customer Data; account credentials; transactional email contents; audit logs | United States — us-east-2 (Ohio) | aws.amazon.com/compliance/gdpr-center |
| Supabase, Inc. | Managed PostgreSQL database (primary application data store) | All operational Customer Data | United States | supabase.com/legal/dpa |
| Vercel, Inc. | Frontend hosting and edge network for hangaros.com and the dashboard | IP address, user agent, page-view metadata | Global (edge), United States (origin) | vercel.com/legal/dpa |
Payment Subprocessors
| Subprocessor | Purpose | Data processed | Location | Privacy / DPA |
|---|---|---|---|---|
| Payment processor — to be designated | Subscription payment processing for HangarOS subscription fees, performed by a third-party Payment Processor we engage. No payment processor is currently engaged. The identity of the Payment Processor will be added to this row on at least 30 days' notice before any subscription charges are processed. | Cardholder data (via hosted fields; not exposed to HangarOS), billing address, subscription state, payout records, 1099-K data | To be designated | To be designated |
Optional / Customer-enabled integrations
| Subprocessor | Purpose | Data processed | Location | Privacy / DPA |
|---|---|---|---|---|
| Intuit Inc. (QuickBooks Online) | Invoice generation and synchronization for the Invoicing module (only if the Customer connects a QuickBooks Online account) | Invoice line items, customer (student) name and email, billing addresses, amounts | United States | intuit.com/privacy |
Identity providers (optional / customer-enabled)
| Subprocessor | Purpose | Data processed | Location | Privacy / DPA |
|---|---|---|---|---|
| Google LLC | Federated sign-in via Google OAuth (only if the user chooses Google sign-in) | Email, name, Google account identifier | United States | policies.google.com |
| Microsoft Corporation | Federated sign-in via Microsoft Entra ID (only if the user chooses Microsoft sign-in) | Email, name, Microsoft account identifier | United States | privacy.microsoft.com |
Observability and analytics
| Subprocessor | Purpose | Data processed | Location | Privacy / DPA |
|---|---|---|---|---|
| Sentry, Inc. | Error and performance monitoring (frontend and backend) | Stack traces, request context, user session identifier; input fields masked | United States | sentry.io/legal |
| PostHog, Inc. | Product analytics (feature usage; no recording of input fields) | Pseudonymous user identifier, event names, company grouping, GCLID (where present) | United States | posthog.com/privacy |
| Google LLC (Google Analytics 4) | Marketing-site analytics (consent required where applicable) | Pseudonymous user identifier, page views | United States | policies.google.com |
| Google LLC (Google Ads) | Marketing conversion measurement (consent required where applicable) | GCLID, conversion events | United States | policies.google.com |
Support
| Subprocessor | Purpose | Data processed | Location | Privacy / DPA |
|---|---|---|---|---|
| Zoho Corporation | Chat widget (Zoho SalesIQ) for customer support on hangaros.com | Visitor/session cookies, chat transcripts, IP address, page being viewed | United States, India | zoho.com/privacy.html |
| Zendesk, Inc. | Help Center / knowledge base hosted at hangaros.zendesk.com (signed-in users only) | Email, name, article-view history | United States | zendesk.com/company/agreements-and-terms |
AI
| Subprocessor | Purpose | Data processed | Location | Privacy / DPA |
|---|---|---|---|---|
| Groq, Inc. | Large language model inference for AI-assisted features in the Service (lesson report drafting, squawk analysis, maintenance intelligence, weather risk advisory, student progress analysis, document assistance) | The text content that the AI feature operates on at the time the feature is invoked, which may include Customer Data the Customer chooses to surface to AI features | United States | groq.com/privacy-policy |
Notes
- “Location” refers to the country of primary processing. Some Subprocessors may use sub-providers in other locations for limited functions; consult each Subprocessor's privacy page for details.
- “Customer Data” has the meaning given in our Terms of Service.
- The Service does not send full payment card numbers to HangarOS servers; once a Payment Processor is engaged, cardholder data will be handled by that processor through hosted fields. HangarOS retains only card brand, last four digits, and transaction identifiers.
- If you do not enable the Invoicing module, Intuit / QuickBooks does not process your data.
- If you do not use Google or Microsoft sign-in, those providers do not process your sign-in data.
Contact
Questions about Subprocessors: privacy@hangaros.com
OrangeTree Technologies LLC d/b/a HangarOS
4801 Glenwood Ave, Suite 200, Mailbox 31
Raleigh, NC 27612
United States
Last updated: May 22, 2026.