| Sub-processor | Service | Data | Region | Safeguard |
|---|---|---|---|---|
| Render Services, Inc. | Hosting, database | All | Frankfurt, Germany (EU) | DPA; the UK's adequacy regulations for the EU; UK Addendum for support access from the US |
| Cloudflare, Inc. | DNS, CDN, object storage for card images | Card assets, static pages | EU jurisdiction setting | DPA; UK Addendum |
| Resend, Inc. | Transactional email | Email addresses, names | US | DPA; UK Addendum |
| Functional Software, Inc. (Sentry) | Error monitoring | Scrubbed error reports, no personal data | EU | DPA |
| Whop, Inc. | Billing: plan subscriptions and counter kit orders | Owner billing contacts and payment details; card data is held by Whop, never by us | US | Whop terms and DPA (UK transfer mechanism to confirm before launch) |
| Google LLC | Google Wallet API; Business Profile API | Pass content; reviews and replies | Global | Google terms; independent controller for Wallet |
| Apple Inc. | Wallet and push notifications | Pass content; push tokens | Global | Apple terms; independent controller for Wallet |
| Better Stack | Uptime monitoring | None personal | EU | Terms |
| Meta Platforms (WhatsApp) | Enquiries sent to us by WhatsApp | What you choose to send | Global | WhatsApp Business terms; used for enquiries and support only |
Last change: initial list, 29 October 2026.