Sub-processors
Last updated:
Draft — to be reviewed by a lawyer before launch. This list is not in force yet.
These are the service providers that process personal data for us, including the client records we hold for businesses under our Data Processing Addendum. Each one is bound by a contract with data protection terms. We tell businesses at least 30 days before we add or replace one.
1. In use
| Provider | What they do for us | Data | Where |
|---|---|---|---|
| Supabase, Inc. | Database, sign-in, file storage and server functions | All account, booking, business and client record data | EU (Ireland) |
| Cloudflare, Inc. | Hosting our website and booking pages, network security, DNS | IP address, pages requested | Worldwide network; EU–US Data Privacy Framework |
| Resend (Plus Five Five, Inc.) | Sending emails: sign-in codes, confirmations, reminders | Email address, name, booking details in the message | United States; Data Privacy Framework and Standard Contractual Clauses |
| Google Ireland Limited (Firebase Cloud Messaging) | Delivering push notifications | Device token, notification text | EU and United States; Data Privacy Framework |
| Apple Distribution International Ltd (Apple Push Notification service) | Delivering push notifications on iPhone | Device token, notification text | United States; Data Privacy Framework |
| OpenStreetMap Foundation (Nominatim) | Finding the map point for an address typed in WhenBy | Address text only, sent from our server | United Kingdom; UK adequacy decision |
| HeiGIT gGmbH (openrouteservice) | Travel times between home visits | Map coordinates only, sent from our server | Germany |
| OpenFreeMap | Map tiles shown in the app | IP address, the map area viewed | EU |
2. When the feature is switched on
| Provider | What they do for us | Data | Where |
|---|---|---|---|
| Google Ireland Limited (Google Analytics 4, Google Analytics for Firebase) | Usage analytics, only with consent | Random identifier, pages and screens viewed, device and browser details, IP address (not stored) | EU and United States; Data Privacy Framework |
| Stripe Payments Europe, Limited | Billing Plans; prepayments and deposits to businesses (Stripe Connect) | Name, email, billing details, payment details (held by Stripe) | Ireland and United States; Data Privacy Framework and Standard Contractual Clauses |
3. Changes
Last change: first version. To be told about changes, businesses receive an email at their billing address. Questions: [CONTACT EMAIL].