Sub-processors

_We give restaurants 30 days' notice before adding one_

| Provider | What it does | Data | Where | Safeguard | |---|---|---|---|---| | Supabase Inc. | Database, sign-in, live updates, backups | All service data | India | Supabase DPA; approved contract clauses; UK Addendum for US support access | | Vercel Inc. | Hosts the web app; security logs (IP, up to 7 days) | Requests passing through | Global edge; US company | Vercel DPA; UK–US Data Bridge if certified, else UK Addendum | | Functional Software Inc. (Sentry), only if switched on | Error reports, no IP stored | Error details (page, browser, error text) | US / [EU region option] | Sentry DPA; UK Addendum | | Planned, OFF: Resend (email), Twilio (SMS) | Offer and reminder messages | Email or phone of guests who opted in | US | Added here with 30 days' notice before use | | Planned: Dojo (Pay at Table, UK) | Card payments at the table | Bill amount; card data stays with Dojo | UK | Dojo is its own controller for card data | | Not a sub-processor: Anthropic (setup agent) | Reads the menu a restaurant sends | Menu only, never guest data | US | Rule: no guest or staff data |