Sub-processors
SUB-PROCESSORS · LAST UPDATED 2026-06-06
Every third party we share data with.
14 providers, the exact role, the jurisdiction, and a link to each company's Data Processing Addendum.
| Provider | Role | Location | Purpose | DPA |
|---|---|---|---|---|
| Supabase | Database, auth, file storage | Switzerland HQ · AWS eu-west-1 data | Core platform data — every customer + owner row is here | DPA → |
| Vercel | Hosting, edge functions, request routing | USA (with EU edge nodes) | Web app + REST API | DPA → |
| Cloudflare | DNS, CDN, security, bot mitigation | USA | Every request goes through CF before reaching Vercel | DPA → |
| Stripe Payments Europe Ltd | Payment processing | Ireland (HQ) · Stripe Inc. USA (parent) | Shop subscription billing + customer deposit collection via Connect | DPA → |
| Resend | Transactional email | USA · EU data residency configured for us | Booking confirmations, reminders, magic-link sign-in, deletion confirmations | DPA → |
| Twilio | SMS delivery | USA | Pro+ shops only — SMS reminders + waitlist offers | DPA → |
| Google (Firebase Cloud Messaging) | Android push notifications | USA | Push delivery to com.dropinly.customer + com.dropinly.owner | DPA → |
| Apple (APNs) | iOS push notifications | USA | Push delivery to iOS apps | DPA → |
| Sentry | Error monitoring | USA | Anonymized stack traces and breadcrumbs from production crashes (90-day retention) | DPA → |
| PostHog | Product analytics | EU (Frankfurt) | Pageviews, booking funnel events, anonymized device fingerprint (365-day retention) | DPA → |
| Google OAuth | Sign-in identity provider | USA | Only if you choose Sign in with Google — we receive your Google sub + basic profile | DPA → |
| Microsoft Azure AD / Entra ID | Sign-in identity provider | USA / EU (Microsoft's choice) | Only if you choose Sign in with Microsoft | DPA → |
| Apple Sign In | Sign-in identity provider | USA | Only if you choose Sign in with Apple | DPA → |
| cron-job.org | External scheduler hitting /api/cron/* endpoints | Germany | Notification dispatch, slot sweep, reminder enqueue, cascade trigger, deletion finalization | DPA → |
How we add new sub-processors
We publish material changes to this list at least 14 days before they take effect. Owners on the platform can object to new sub-processors during this window by emailing [email protected]. Continued use after the change-effective date is treated as acceptance.