Subprocessor List
Appraiser Guru™ by Tarnwick LLC · Last Updated: October 6, 2026
1. Overview
This Subprocessor List identifies all third-party services and providers ("Subprocessors") that process user data on behalf of Tarnwick LLC. A subprocessor is any external service that receives, stores, analyzes, or otherwise processes information from the Appraiser Guru platform on Tarnwick's behalf.
The table below covers every service that receives your account information, your report content, your uploaded files, or a property address or coordinate. Services that receive none of those — for example the font and browser-component downloads our servers make to render a report — are not listed, because no information about you or your work reaches them.
This list is maintained for transparency and compliance with data protection regulations, including GDPR and similar privacy laws.
2. Active Subprocessors
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Supabase | Database, authentication, file storage | Account data, appraisal reports, files, session tokens | United States |
| Anthropic, PBC | AI features (Claude models), as our service provider: the Guru assistant and problem reports, narrative drafting, market-area descriptions, reading orders, uploaded appraisal PDFs, pasted listings and assessor pages, HUD data plate and elevation photos, and template clean-up (Privacy Policy §2.6) | Questions to Guru and the report details it uses (subject address, file number, property characteristics, missing fields, check results, MLS summary figures, fields Guru looks up); problem reports and their screenshots; for narratives, property characteristics, opinion of value, contract price, subject address and comparable figures by number (no comparable addresses); MLS search map screenshots and search criteria; order text, including borrower name and contact details, loan and case numbers, and lender, client and AMC details (quoted replies, signatures and disclaimers removed); the first page of uploaded appraisal PDFs; pasted MLS listings (agent and office names, contact details and remarks removed); pasted assessor and property-data pages (owner and other party names, and CoreLogic value estimates and scores, removed); HUD data plate and elevation photos; your template text. Never: passwords, payment details, an identifier for you, or your MLS market-data export. | United States |
| Vercel | Web hosting, serverless functions, CDN; Vercel Web Analytics (page-view counts — Cookie Policy §3) | HTTP requests, IP addresses, usage logs; for Web Analytics, each page view's time, page address, referring page, approximate location, browser, operating system and device type | United States (global CDN) |
| Railway | Hosting for the PDF rendering service that produces your report PDF | The complete rendered appraisal report, including all report content and links to its photographs | United States |
| Stripe (payments) | Payment processing, subscription billing | Payment method, billing address, transaction history | United States |
| Stripe Identity | Identity verification for Data Sharing Pool enrollment | Government-issued ID document and a selfie image, collected and retained by Stripe. Tarnwick receives only a pass or fail result | United States |
| SendGrid (Twilio) | Inbound intake of order emails sent to your forwarding address; outbound transactional email | Email addresses, message subject and body, and any attachments to those messages | United States |
| Malware scanning service (self-hosted) | Scanning uploaded files for malware before they are stored | The full contents of each file scanned, at the moment of upload. See the scanning coverage described in Privacy Policy § 7 | Self-hosted virtual server |
| Sentry | Application error monitoring and diagnostics | Error reports with page URL, browser and device details, and IP address. When an error occurs, a replay of the screen with all text masked and media blocked | Sentry-hosted (region set by our account) |
| Google (Maps, Street View, Geocoding) | Address geocoding, map images, Street View property images | Property addresses and coordinates | United States |
| FEMA | Flood zone determination | Property coordinates | United States |
| U.S. government and public data services (Census Bureau, FCC, HUD, USGS, EPA, USDA, FHFA) | Public-record lookups that populate neighborhood, site and market data | Property addresses or coordinates only | United States |
| State of Hawaii GIS (Statewide GIS Program) | Lava flow hazard zone lookups for properties in Hawaii | Property coordinates | United States |
| OpenStreetMap | Map tiles, geocoding, nearby-feature lookups | Property addresses and coordinates, map viewport coordinates | Global |
3. Data Protection Agreements
3.1 DPA and Processing Terms
Planned, not yet complete. Putting a Data Processing Agreement (DPA) or equivalent terms in place with every subprocessor listed above is planned work that we have not finished. We have not confirmed that a DPA is in force for each provider named here, and we do not represent that one is. Several of these providers publish standard data processing terms that apply to their customers; we are establishing which of those are in force for our accounts and will execute agreements where they are not. We will state the date here when that work is complete.
3.2 User Access to DPAs
Users who require copies of DPAs or have questions about data processing terms can contact info@tarnwick.com.
4. Subprocessor Changes and Notifications
4.1 Addition of New Subprocessors
If Tarnwick engages a new subprocessor, we will provide notice at least thirty (30) days before it begins processing data, including the name, location, purpose, type of data processed, and your right to object (if applicable under law).
4.2 User Objection Rights
In jurisdictions where applicable law grants users the right to object to new subprocessors (such as under GDPR), users may object within a specified period. Tarnwick will either find an alternative subprocessor, modify processing to eliminate the need, or allow the user to terminate their account without penalty.
4.3 Removal of Subprocessors
If Tarnwick discontinues use of a subprocessor, we will notify users. Data held by removed subprocessors will be returned to Tarnwick or securely deleted per data protection agreements.
5. International Data Transfers
Tarnwick's subprocessors process data in the United States except where the table above says otherwise. Appraiser Guru is offered only for appraisals of property located in the 50 states, the District of Columbia, Puerto Rico, the U.S. Virgin Islands, and Guam. All data is processed and stored in the United States. Appraiser Guru is not offered in the European Economic Area, the United Kingdom, or Switzerland (see Privacy Policy § 13).
Users in the EU or other data protection jurisdictions can contact info@tarnwick.com for specific information about safeguards.
6. Security and Compliance
6.1 Security Requirements
We select subprocessors that publish appropriate technical and organizational security measures, including encryption in transit (TLS/HTTPS), encryption at rest, access controls and authentication, security testing, and incident response and breach notification procedures. Until the agreements described in § 3.1 are in place, those are commitments each provider makes publicly to its own customers rather than obligations Tarnwick has imposed by separate contract.
6.2 Compliance Certifications
Many Tarnwick subprocessors hold industry-standard certifications including SOC 2 Type II, ISO/IEC 27001, GDPR compliance, and PCI DSS (for payment processing). Current certification information is available from each subprocessor's website.
7. Third-Party Privacy Policies
Users should review the privacy policies of subprocessors to understand their independent data handling practices:
- Supabase: supabase.com/privacy
- Anthropic: anthropic.com/legal/privacy
- Google: policies.google.com/privacy
- Stripe (including Stripe Identity): stripe.com/privacy
- Vercel: vercel.com/legal/privacy-policy
- Railway — see the privacy policy published on Railway's website
- SendGrid — see Twilio's privacy policy
- Sentry — see the privacy policy published on Sentry's website
8. Contact and Updates
Tarnwick LLC
1625 Ridge Rd
Highland, MI 48356
Support: tarnwick.com/support
Email: info@tarnwick.com
This Subprocessor List is maintained in accordance with data protection regulations and updated as Tarnwick's technology partnerships evolve. Significant changes will be communicated to users via email.