Sub-processors
Last updated: November 13, 2026
This page lists the third-party sub-processors that Service uses to process personal data on behalf of restaurants (Controllers) in connection with the Service platform.
Changes to this list are notified to Controllers at least 15 days in advance, in accordance with our Data Processing Addendum.
Infrastructure
| Sub-processor | Purpose | Location |
|---|---|---|
| Google Cloud Platform (Google Ireland Ltd) | Cloud hosting (GKE, Cloud SQL, Memorystore, Cloud Storage, Secret Manager) | EU (europe-west9, Paris, France) |
| Cloudflare (Cloudflare Inc.) | DNS resolution only (no proxy, no content data) | Global (DNS edge, SCCs for non-EU transfers) |
Communication
| Sub-processor | Purpose | Location |
|---|---|---|
| Expo (650 Industries Inc.) | iOS push notifications (device token, event type) | USA (SCCs Module 3) |
| Brevo (Sendinblue SAS) | Transactional email and SMS (confirmations, reminders, guarantee and payment notifications): guest email address, phone number and name, message content | EU (France) |
| Twilio (Twilio Inc.) | Missed Calls service: the phone number that receives forwarded calls, the spoken greeting, the caller's line type check, routing of text messages and WhatsApp messages (caller's number, time of the call, message content, WhatsApp profile name) | USA (EU-U.S. Data Privacy Framework; otherwise Binding Corporate Rules or SCCs) |
| WhatsApp (WhatsApp Ireland Ltd, Meta Platforms group) | Missed Calls service: WhatsApp messaging with the caller (number, profile name, message content) | EU (Ireland) and USA (standard contractual clauses, WhatsApp Business Data Transfer Addendum) |
The Missed Calls spoken greeting is read by a Google synthetic voice, produced by Twilio: only the greeting text written by the restaurant is sent, no caller data.
AI Services
| Sub-processor | Purpose | Location |
|---|---|---|
| Anthropic (Anthropic PBC) | Missed Calls service: the automated assistant (Claude model) reads callers' messages to extract the request (date, time, party size, name, details). The assistant never writes free text to the caller. AI translation of the restaurant's own content (guest-facing texts, website): names of services, rooms and closure periods, messages shown on the widget, menus and pages of the restaurant's website. For this purpose, no guest data is sent. Anthropic does not use data sent through its API to train its models. | USA (SCCs Module 3) |
Error Monitoring
| Sub-processor | Purpose | Location |
|---|---|---|
| Sentry (Functional Software, Inc.) | Detecting and diagnosing errors in the server, the back office, the booking widget and the mobile app: a technical description of the error, the page or request involved, device and browser, internal ids (restaurant, reservation), and, for staff signed in to the back office or the app, their user id and email address. Before anything is sent, guests' personal fields (phone, email, name, notes, special requests, allergies, date of birth, comments) are replaced with "[redacted]", and tokens in addresses (booking-change and review links) are masked. The Missed Calls service sends ids only, never message text. Alerts are relayed to the team's internal chat (Slack): the error's title, a link to Sentry, project and environment only. | EU (Frankfurt, Germany): error events are stored there, with no transfer outside the EU for that storage. Sentry keeps account metadata (Sentry user accounts, organization settings) in the United States and may access data under its data processing agreement. |
Payments
| Sub-processor | Purpose | Location |
|---|---|---|
| Stripe (Stripe Payments Europe Ltd) | Payment processing for credit card guarantees, deposits, and no-show fees | EU (Ireland) |
Sub-processors NOT used
For transparency, the following categories are not used:
- Advertising / retargeting
- Third-party analytics on the platform (back office, app, booking widget and pages, restaurants' websites)
- CRM / marketing automation (HubSpot, Salesforce, etc.)
- Cross-restaurant guest data sharing
useservice.app website (outside the platform)
The useservice.app website measures its audience with PostHog (PostHog Inc.; data hosted in the EU, in Frankfurt, Germany; may be accessed from the United States under standard contractual clauses). This processing concerns the site's visitors and the professionals we reach out to; Service is its controller. PostHog is not loaded on the platform and receives no data processed on behalf of restaurants, so it is not a sub-processor within the meaning of this list. Messages sent through the site's contact form are stored in Service's database (Google Cloud Platform, Paris) and signalled to the team by a Slack notification. All of this is described in Section 13.2 of our privacy policy.
Change notifications
Controllers are notified by email at least 15 days before a new sub-processor begins processing data.
For any questions, contact us atsupport@useservice.app.