1. The list
K-Stra runs on a dedicated server in Sydney. These are the only providers that receive data from the service, and only what is described here. Each one is bound by its own data protection terms.
| Provider | Purpose | Location | What it receives |
|---|---|---|---|
| OVHcloud | Dedicated server and backup storage | Australia (Sydney, SYD03) | All data of the service: accounts, analyses, reports, uploaded files, backups. |
| Stripe | Payments, invoices, subscriptions | United States / European Union | Billing email and organisation details, amounts, GST registration (Australia and New Zealand). Card details are held by Stripe only. |
| Brevo | Email delivery | European Union (France) | Recipient, subject and content of every email the app sends, including sign-in codes, invitations, run notifications with figures from analyses, and scheduled reports with attachments. |
| Google (Gemini API, paid tier) | AI assistant and AI writing in reports | United States | Questions and conversation, the analysis on screen with a summary of its results (which can include values from uploaded files), an image of the map view, and the report tables the AI is asked to write about. Not used by Google to improve its products. |
| Mapbox | Map tiles and geocoding | United States | Map tile requests from your browser (IP address, area on screen). For geocoding, only the address text of records without coordinates, after confirmation. |
| Google (Street View metadata) | Checking whether a street panorama exists for a property listing | United States | Coordinates of a property listing, sent by our server. No customer data. |
| Google and Microsoft | Sign-in, only if you choose it | United States / European Union | K-Stra receives your name, email and photo from the provider; nothing is sent to it. |
| VIES (European Commission) and ABN Lookup (Australian Business Register) | Checking business tax numbers | European Union / Australia | The VAT number or ABN entered in billing details. |
Webhooks and API results go to the addresses that customers configure themselves. The country of a visitor is derived on our own server from a local database (DB-IP Lite, licensed under CC BY 4.0), without any outside call.
2. Which providers can see customer data
Only three steps can carry content of uploaded files outside the K-Stra server: geocoding (Mapbox, address text only, after confirmation), the AI assistant and AI writing in reports (Google Gemini) and email notifications and scheduled reports (Brevo). Map tiles, payments, sign-in and tax-number checks never receive uploaded files.
3. Changes to this list
We email the owners of each organisation at least 30 days before adding a provider that receives customer data. The version and effective date at the top of this page change with every update.
Provider details: write toinfo@k-stra.com