Vendor List & DPA Assessment

Current optional geographic map notice

When Geoapify geographic maps are enabled, your browser requests background tiles directly from Geoapify. Those requests include the selected style, tile coordinates and zoom level, a public map-display key, your IP address, browser request information and this website's origin. The requested tiles reveal the geographic area being viewed.

VIDIK360 draws business markers, ranks and selected points locally. It does not add business names, ranking queries, prompts, account IDs, credit balances or private scan evidence to tile requests. Opening or changing the map does not run a ranking scan or spend scan credits. Geoapify map usage is separate from ranking collection.

An explicit style choice can be saved in this browser for the signed-in user. This is a display preference, not advertising tracking. Map tiles use ordinary browser caching; VIDIK360 does not add an offline tile store, a geocoder or a map-image export. Coordinate and result-list views remain available without background tiles.

Map attribution identifies Geoapify and the geographic data sources. See the Geoapify privacy policy for its processing. This technical notice describes the enabled map feature; it does not claim a signed data-processing agreement, a data residency commitment or legal approval.

This current notice supplements the map description in the staging draft below. Historical document versions and prior acknowledgements are preserved unchanged. Geographic maps remain configuration-dependent; this notice does not imply that they are enabled in every environment.

Scope of this list

This is an integration inventory for staging review, not a finalized subprocessor schedule. Contracting entities, selected regions, subprocessors, transfer terms and retention must be verified against the actual accounts before launch. A vendor name does not establish a certification, residency guarantee or completed DPA.

Connected services

Cloudflare: application hosting, static assets, background Workflows and scheduled dispatch; processes requests, job identifiers and operational metadata. Supabase: email/password authentication, account identities, workspace database and configured private evidence storage. Local database connection credentials remain outside Worker bindings.

Stripe: TEST checkout, portal, subscriptions, top-ups, invoices, cancellations, refunds and reconciliation. Card entry is hosted by Stripe; application records retain billing identifiers and credit state. DataForSEO: configured Maps, organic Search and AI scraping provider; receives task inputs such as queries, coordinates or provider location settings when an authorized call runs. Credentials alone do not enable paid work.

Resend: Supabase SMTP authentication mail and explicitly permitted report messages to verified recipients. Sentry: allowlisted operational incidents through the application monitoring hook when enabled. Management verification tokens remain local.

Google and AI platforms are underlying sources of provider-returned results, not automatically direct VIDIK360 account integrations. No direct Google Business Profile OAuth, Google Maps SDK, external tile service or separate direct AI-model API is active in the reviewed UI.

Commercial data and map licensing

DataForSEO publicly describes white-label AI data use in customer interfaces, dashboards and client deliverables, and its operational guidance supports storing retrieved results. Those statements support the intended analytics use case. They do not establish unrestricted raw-result resale, transfer third-party copyrights or settle every full-answer, evidence-export or redistribution use. Confirm the intended retained evidence and export scope against the actual contract before commercial release.

The current map is an inline coordinate plot without third-party tiles. Adding a tile, geocoding or Maps SDK provider requires a separate license, attribution, caching and privacy review. Source data, geographic assets and future providers must each be assessed; an unused mapping library does not supply data rights.

Is a DPA needed?

The service can process business-contact and workspace-user personal data, including material customers submit or receive in evidence. If VIDIK360 processes that information for a customer subject to processor-contract requirements, a customer DPA is likely needed. This is a preliminary assessment, not a legal conclusion about every customer or jurisdiction.

Before launch, counsel should map controller/processor roles, purposes and instructions; verify vendor DPAs and onward processors; define assistance with access/deletion requests, incidents and audits; agree security measures and deletion/return at termination; and assess any international transfers. No signed customer DPA or completed transfer assessment is claimed by this draft.