Legal
Subprocessors
These are the third parties that may process customer data on Further Theory's behalf. Each is bound by a written contract limiting it to processing on our instructions, and our agreements with the model providers prohibit them from using data we send through their business interfaces to train their models.
Effective 14 September 2026 · Further Theory, LLC, Boston, Massachusetts · legal@baseworthy.com
1 Current list
| Subprocessor | Purpose | Data | Region |
|---|---|---|---|
| Supabase, Inc. | Application database, authentication, and transactional auth email | Account details, workspace membership, all Customer Data | United States |
| Amazon Web Services, Inc. | Underlying cloud infrastructure for the managed database | All data at rest, encrypted | United States |
| OpenAI, L.L.C. | Language models for reading requests, researching manufacturers, drafting RFQs, triaging supplier replies and normalizing quotes | Request descriptions, uploaded drawings and specifications, linked pages, supplier correspondence and the quotes returned | United States |
| Vercel, Inc. | Application hosting, edge delivery and request logging | Requests, IP addresses, and data in transit | United States |
2 How this list changes
2.1Authorisation. Customers give general written authorisation for the subprocessors above and for any replacement or addition notified under 2.2, as provided in our data processing addendum, which we provide on request.
2.2Notice. Further Theory will post a new subprocessor here at least fifteen days before it begins processing customer data, and will email customers who have subscribed to notice at privacy@baseworthy.com. Where a change is urgent, needed to maintain the Service, or made to replace a failing vendor, Further Theory may act first and post promptly afterwards.
2.3Objection. A customer may object in writing within fifteen days of notice, on reasonable data-protection grounds, describing them. Further Theory will use commercially reasonable efforts to offer an alternative arrangement. If it does not do so within thirty days, the customer’s sole and exclusive remedy is to terminate the affected subscription on written notice, with a pro-rated refund of pre-paid, unused fees. Objection is not grounds for withholding payment or for damages.
2.4Ancillary vendors. Providers of tools that do not process customer data in the ordinary course — accounting, payroll, corporate email, code hosting, error reporting configured to exclude payloads — are not listed here. Further Theory will identify any of them on request from a customer’s security reviewer.