JEKA Policies

Version 1.2 — in force since August 31, 2026. If you accepted this policy inside a JEKA application, the version you accepted there governs. All policies

MYWATCHTOWER SUB-PROCESSOR LIST

Version 1.2 • Effective Date: August 31, 2026

This Sub-processor List identifies the third parties that JEKA Software, Inc. (“JEKA,” “we,” “us”) engages to process Community Personal Data on JEKA’s behalf in connection with the MyWatchtower Services (each, a “Sub-processor”). “Community Personal Data,” “Services,” and “Sub-processor” have the meanings given in the MyWatchtower Data Processing Addendum (the “DPA”). This List is the posted list referenced in DPA Section 7.3, and it identifies the service providers referred to in Section 4 of the MyWatchtower Platform Privacy Notice and Section B.2a of the MyWatchtower Terms of Service.

This List covers Sub-processors of Community Personal Data only. Vendors that process only JEKA’s own business records — for example invoicing, electronic signature of agreements, source control, or corporate email — are outside its scope and are not listed here.

1. Where this List lives

The current version of this List is published at https://portal.jekasoftware.com/policies/subprocessors/. Once published, the posted List is the operative record of JEKA’s approved Sub-processors; Annex C of a Community’s DPA states the List as of that DPA’s effective date. Each version of this List is immutable once published, and prior versions remain available.

2. How this List changes

  • Update before deployment. JEKA adds a new Sub-processor to this List before that Sub-processor processes Community Personal Data — where practicable, at least 30 days before (DPA Section 7.3). A replacement Sub-processor engaged for security, continuity, or emergency reasons may be engaged immediately, with notice as soon as practicable.
  • Change notifications. Communities may subscribe to notifications of changes to this List by emailing legal@jekasoftware.com with the subject line “Subscribe: Sub-processor List”. Each change is also recorded in this List’s change log.
  • Objection. A Community’s right to object to a new Sub-processor, and the parties’ process and remedies, are as stated in DPA Section 7.3.

3. Current Sub-processors

Each entry states the Sub-processor, its location, the function it performs for the Services, the categories of Community Personal Data it processes, and its status.

  • Voxtelesys, LLC, together with 3CX — Location: United States (Voxtelesys, LLC; 3CX — U.S. headquarters, Tampa, Florida) — Function: voice and SMS delivery for kiosk voice-call sessions and notifications — Data: telephone numbers, call audio and message content in transit, delivery metadata — Status: current.
  • Twilio Inc. — Location: United States — Function: SMS notification delivery — Data: telephone numbers, message content, delivery metadata — Status: current; planned expansion to voice and SMS delivery now carried by Voxtelesys, LLC and 3CX.
  • Microsoft Corporation (Microsoft Clarity) — Location: United States — Function: web usage analytics for the MyWatchtower application — Data: device and usage data, session interaction data (consent-gated where the consent tool is deployed) — Status: current.
  • Google LLC (Google Analytics 4) — Location: United States — Function: web usage analytics for the MyWatchtower application — Data: device and usage data, online identifiers (consent-gated where the consent tool is deployed) — Status: current.
  • Cloudflare, Inc. (Cloudflare Turnstile) — Location: United States — Function: human-verification challenge and content delivery for web forms — Data: IP address, user agent, browser characteristics — Status: current.
  • Brivo Systems LLC — Location: United States — Function: cloud access control (technical) platform — Data: access credentials and access events — Status: engaged only where the Brivo Integration Addendum (Direct form) applies (JEKA-held Brivo Account). Under the Channel form the Brivo Account is held by the Integrator or End Client and Brivo is not JEKA’s Sub-processor.
  • Microsoft Corporation (Microsoft Azure) — Location: United States — Function: production cloud compute for the platform — the application programming interface and background services, the “data centers of reputable cloud providers” described in DPA Annex B item 9 — Data: all categories of Community Personal Data processed by the Services — Status: current.
  • Supabase, Inc. — Location: United States — Function: production database, authentication, and file storage for the platform — Data: all categories of Community Personal Data stored by the Services, including user account and credential data — Status: current.
  • Netlify, Inc. — Location: United States — Function: web application delivery for the MyWatchtower application (application assets and edge network) — Data: IP addresses, device and browser data of application users — Status: current.

4. Not Sub-processors

The following are not Sub-processors under this List and are not listed above:

  • Third-party platforms your Community chooses to use with MyWatchtower — for example Brivo or HID access control (technical) platforms under the Channel form, or Eagle Eye Networks video services — which process data under their own agreements with the Community and their own privacy policies.
  • Third-party sign-in providers (Facebook, Google, or Apple) that a user chooses to authenticate through, which act under their own terms.

5. Questions

Questions about this List: legal@jekasoftware.com, or through the support portal at support.jekasoftware.com. JEKA Software, Inc., 16703 Early Riser Avenue, Suite 533, Land O’ Lakes, FL 34638.