Sub-processor Register

1. What this register is

1.1 The authoritative list. This register is the authoritative list of the sub-processors Yielde engages to deliver its products, what they process, where they are hosted, and the cross-border position under POPIA.

1.2 Platform customers. This register is an annex to, and is incorporated by reference into, each platform customer's Yielde Data Processing Agreement (the "DPA"). For platform customers, Table A is the list of authorised sub-processors.

1.3 Why it exists. An operator may process personal information only with the knowledge or authorisation of the responsible party (POPIA section 20). The written operator contract must make sure the operator keeps the security measures in POPIA section 19 (section 21(1)). This register is how our customers know, and authorise, who processes their information for them.

1.4 Section numbers. The section numbers changed in this version. The right to object, which was section 5.3, is now section 7.3. The source of truth (section 5.1) is now section 7.1, advance notice (section 5.2) is now section 7.2, and emergency replacements (section 5.4) are now section 7.4. The platform safeguards (section 4) are now section 6.1, and security compromises (section 6) are now section 8. The two platform tables (sections 2 and 3) are now Table A in section 4. A reference to an old number, for example in a signed DPA, points to the matching section of this version.

2. Who is responsible for what

2.1 POPIA roles depend on the job, not the company. One business can be the operator for one set of information and the responsible party for another (POPIA section 1).

2.2 Platform. In the typical platform engagement, the customer is the responsible party for its end-users' and leads' personal information. Yielde is the operator. The providers in Table A are sub-processors Yielde engages to deliver the service. Separately, Yielde is a responsible party for its own site, account, authentication, subscription and billing data. For that information, several providers in Table A act as Yielde's own operators.

3. Transfers outside South Africa

3.1 The rule. POPIA section 72(1) says a responsible party in South Africa may not transfer personal information to a third party in a foreign country unless one of five grounds applies. Two of them matter here:

• Section 72(1)(a): the recipient is subject to a law, binding corporate rules or a binding agreement that gives an adequate level of protection. That protection must uphold principles substantially similar to POPIA's conditions for lawful processing, and must include substantially similar rules on onward transfer to third parties in other countries.
• Section 72(1)(c): the transfer is necessary for the performance of a contract between the data subject and the responsible party, or for the implementation of pre-contractual measures taken in response to the data subject's request.

3.2 The platform processes personal information outside South Africa. Yielde's automation runs on Vercel (serverless) and Supabase (eu-west-1); model calls go via OpenRouter. Platform data is therefore processed in the European Union (Supabase), the United States (Vercel) and by OpenRouter's model providers, as well as by the other providers in Table A. The table below says where each provider processes it.

3.3 Platform basis. For each cross-border platform sub-processor we rely on section 72(1)(a). South Africa has no published adequacy list and no standard contractual clauses issued by the Information Regulator. So we self-assess and document the adequacy of each cross-border recipient, and rely on each provider's data-processing terms, plus, where necessary, a POPIA onward-transfer rider. Section 6.1 lists the safeguards that go with this. Paystack handles Yielde's own billing records (section 2.2). It stores data on AWS in Ireland, and may transfer data to other Paystack group companies under its binding corporate rules. For Paystack we rely on section 72(1)(a), through its binding corporate rules and its terms with us, and on section 72(1)(c) where taking payment is necessary to perform our contract with the customer.

4. Table A: Yielde platform

Table A applies to Yielde platform customers. It brings together the two platform lists of 20 June 2026 and adds the changes listed after the table. The transfer-basis column is also new. It points to the basis in section 3.3 and the safeguards in section 6.1. It is not a separate assessment of each provider.

What changed in Table A on 27 September 2026.

• Sentry added. Our Cookie Policy already named Sentry, but this register did not list it.
• Cloudflare's email work added. The register listed Cloudflare only for DNS and access sign-in. Cloudflare also receives the lead emails platform customers forward to Yielde, and the delivery events described below.
• AI routes described more exactly. The OpenRouter row now says that AI Chat's live web search and video generation call OpenRouter directly from our application server on Vercel. The Retell row now says that the voice receptionist runs on a language model Retell provides for voice calls. The note "The AI model path" below sets out every route.
• Paystack's location corrected. The last version listed Paystack as in South Africa, with no transfer out of South Africa. Paystack stores data on AWS in Ireland, and may transfer data to other Paystack group companies under its binding corporate rules. The row now says so, with the basis we rely on (section 3.3).
• Supabase's data described in full. The Supabase row now also lists the leads the Lead Qualifier scores, AI Chat exports and generated images, and the record of emails sent to leads from AI Chat.

We will send platform customers written notice of these changes, with the details section 7.2 lists. The right to object in section 7.3 runs from the date of that notice, and the notice period is 30 days from that date.

The AI model path. The most significant cross-border flow on the platform is the AI model path. Prompts can carry personal information, and every route below leaves South Africa. A platform AI feature reaches a model in one of two ways:

• Through OpenRouter. Platform model calls come from the lead-qualifier and other workflows, the chatbot, the AI Chat model picker, AI Chat's live web search and video generation. Our application server and automation on Vercel send each call to OpenRouter, which passes it to the selected upstream model provider (which can include OpenAI and Anthropic in the United States).
• Voice calls, through Retell. The voice receptionist runs on a language model that Retell provides for voice calls, in the United States.

OpenRouter operates from the United States and globally. Where a provider passes a call on to another company, as OpenRouter does, the onward-transfer part of section 72(1)(a) applies at that step too.

Email that Cloudflare handles. A platform customer can forward its leads to Yielde by email. Cloudflare Email Routing receives that mail, and a Cloudflare Worker passes it on to the platform. Separately, Resend reports delivery problems (bounced, complained, failed and suppressed mail) for mail sent through Yielde's Resend account, including platform customers' mail. Those reports go to a handler that runs on Cloudflare as part of the Venue Enquiry Desk (now Venuo). The handler keeps nothing from reports about platform mail: it discards them without storing or logging them.

Where the rest sits. Supabase sits in the EU (eu-west-1, Ireland), whose GDPR regime is treated as substantially similar to POPIA. Sentry uses its EU data region (Germany). Vercel, which runs Yielde's application server and automation, is in the United States with a global edge network. Paystack stores data on AWS in Ireland.

5. Venuo

Table B, which listed the sub-processors of the Yielde Venue Enquiry Desk, was removed from this register on 28 September 2026. The Desk is now Venuo. If you use Venuo, our enquiry desk for wedding and function venues, its own privacy notice at https://venuo.co.za/privacy/ applies.

6. Safeguards

6.1 Platform. For every cross-border sub-processor in Table A, the DPA and this register provide for:

• A binding agreement per vendor. Each provider's data-processing agreement or standard contractual clauses, plus, where needed, a POPIA section 72 onward-transfer rider.
• Data minimisation. Minimising or redacting personal information from lead data, where feasible, before it enters the LLM chain (POPIA sections 10 and 15).
• No training on customer data. Contractual confirmation that API data is not used to train or improve models, recorded per vendor.
• Onward-transfer flow-down. Each sub-processor must bind its own sub-processors to substantially similar protections (section 72(1)(a)).
• Back-to-back breach notification. Each sub-processor must notify Yielde promptly enough for Yielde to meet its section 21(2) duty to the customer.
• Region selection. Supabase is hosted in AWS eu-west-1 (Dublin, Ireland), inside the EU, whose GDPR regime is treated as giving protection substantially similar to POPIA for the purposes of section 72(1)(a). We will move to a South African Supabase region if and when one that fits becomes available.
• A prior-authorisation screen. Each flow is screened for special personal information (section 26) or children's personal information (section 34) that would need prior authorisation under section 57(1)(d) before it is routed across the border.

7. Changes to this register

7.1 Source of truth

Yielde keeps this register as the authoritative list of authorised sub-processors. For platform customers it is incorporated into the DPA by reference (section 1.2). We update it before a new sub-processor starts, and we record each change on our changelog.

7.2 Advance notice

Before we add a new sub-processor, replace one, or make a material change to an existing one, we give affected customers at least 30 days' advance written notice. A material change means new categories of personal information, a new hosting country, or a change that creates or worsens a cross-border transfer. The notice identifies:

• the sub-processor;
• its purpose;
• the categories of personal information;
• its hosting location;
• whether the change is cross-border; and
• the proposed section 72 basis.

7.3 Your right to object

• Platform. A customer may object on reasonable, good-faith data-protection grounds within the notice period. Yielde and the customer will discuss the objection in good faith and look for a commercially reasonable resolution. If none is reached, the customer may terminate the affected service without penalty for the unexpired prepaid term, on written notice. If no objection arrives in time, the customer is treated as having authorised the change at the end of the notice period.

7.4 Emergency replacements on the platform

Where a platform sub-processor must be replaced urgently for security, legal-compliance or service-continuity reasons, Yielde may make the change before the notice period ends. We then give notice as soon as reasonably possible, and the customer's right to object still applies.

8. Security compromises

8.1 Platform: Yielde's notice to the customer. As operator, when there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, at Yielde or at any sub-processor, Yielde must notify the customer immediately (POPIA section 21(2)).

8.2 Platform: the customer's notices. The customer, as responsible party, then notifies the Information Regulator and the affected data subjects under POPIA section 22, as soon as reasonably possible after discovery. Yielde will contractually assist the customer to make that notification.

9. Contact

Splice Computers (Pty) Ltd t/a Yielde, registration number 2019/272712/07, 55 York Street, George, Western Cape, 6529, South Africa.

• Questions about this register: support@yielde.dev or 063 611 2952.
• Security vulnerability reports: security@yielde.dev.
• Information Officer: the head of the organisation, by operation of law. Contact: support@yielde.dev.

How we protect personal information is set out on our Security page. How we handle personal information more broadly is set out in our Privacy Policy.