List of Subprocessors

1. Scope of the list

The list covers suppliers that may process data for Detailero as the controller or as the processor of the CRM. For each of them, we state the purpose and scope of the processing.

2. Suppliers

For each supplier, we state its registered office, where the data are stored and whether they may leave the European Economic Area (EEA), and if so, which safeguard covers the transfer. The abbreviation DPF means certification under the EU-U.S. Data Privacy Framework, SCC the European Commission's standard contractual clauses in the data processing agreement.

• Supabase – database, authentication, file storage and backups. Supabase Pte. Ltd., Singapore; we store data in the EU region (Frankfurt). Operations and support may also take place from the USA and Singapore. Safeguard: SCC (data processing agreement).
• Laravel Cloud – hosting of the application interface (api.detailero.com), which works with data in the database. Laravel Holdings Inc., USA; the application runs in the EU region (Frankfurt). Safeguard: DPF (privacy policy).
• Vercel – hosting and delivery of the website and the internal administration; processes visitors' network data including the IP address. Vercel Inc., USA; the detailero.com website and the internal administration run in the EU (Frankfurt), the delivery network is global. Safeguard: DPF and SCC (data processing agreement).
• Stripe – subscriptions, checkout page, customer portal and payment metadata. Stripe Payments Europe, Limited, Ireland; it transfers data to Stripe, LLC in the USA. Safeguard: DPF, additionally SCC (data processing agreement).
• Resend – sending transactional e-mails and e-mails initiated by a Studio. Plus Five Five, Inc. (Resend), USA; e-mails are sent from the EU region (Ireland), the main processing takes place in the USA. Safeguard: DPF and SCC (data processing agreement).
• Cloudflare – DNS, CDN/proxy, hosting of the web application for Studios and protection of forms against automated abuse with Turnstile. Cloudflare, Inc., USA; global network. Safeguard: DPF, additionally SCC (data processing agreement).
• Upstash – rate limiting of submitted inquiries; it works with a fingerprint (hash) of the IP address, not with the address itself. Upstash, Inc., USA; processing may also take place in the USA. Safeguard: DPF, additionally SCC (data processing agreement).
• PostHog – analytics with European storage; without consent, only traffic measurement without cookies using a pseudonymous identifier that changes daily, detailed analytics only after consent. PostHog, Inc., USA; we store data in the EU region (Frankfurt), support may access it from the USA. Safeguard: DPF and SCC (data processing agreement).
• Meta Platforms Ireland Ltd. – the Meta Pixel for measuring ads on Facebook and Instagram; it loads only on the studio page and only after consent in the Marketing category, and not at all in the mobile app. It receives an event about the page visit and about a click on studio registration, the identifiers in the _fbp and _fbc cookies, the IP address and browser data. Meta Platforms Ireland Ltd., Ireland; the data may also reach the USA (Meta Platforms, Inc.). Safeguard: DPF (Meta policy).
• Google Maps Platform – the map in search, location autocomplete and Google Maps reviews on Studio profiles; it receives the IP address, the displayed map area and the entered search text. The contracting party is Google Cloud EMEA Limited, Ireland; Google processes data globally, including in the USA. Safeguard: SCC (clauses for Google Maps Platform); Google LLC is also certified under the DPF.
• Google – Google sign-in and Firebase Cloud Messaging for push notifications. Google Ireland Limited, Ireland, and Google LLC, USA; global service. Safeguard: DPF and SCC (Firebase data processing terms).
• Apple – Sign in with Apple and Apple Push Notification Service. Apple Distribution International Ltd, Ireland; the data are stored by Apple Inc. in the USA. Safeguard: SCC (Apple's privacy policy).
• CARTO – base maps when choosing a Studio's location in the app for Studios; it receives the IP address and browser data. CartoDB Inc., USA. Safeguard: SCC (terms).
• Photon (komoot GmbH) – address lookup when creating a Studio; it receives the IP address and the entered address text. komoot GmbH, Germany; no transfer outside the EEA.

3. International transfers

Where data may leave the EEA, we state the country and the safeguard for the supplier above. DPF certification is based on the European Commission's adequacy decision (EU) 2023/1795; the validity of a certification can be verified in the list of DPF participants. Standard contractual clauses under Commission Decision (EU) 2021/914 form part of the data processing agreements at the links above. We will send you a copy of the safeguards used on request; write to info@detailero.com.

4. Changes

Changes will be published here and announced to Studios in advance in the manner set out in the Data Processing Addendum . The version history will state the date, the supplier added or removed and the purpose of the change.

5. Contact

Questions about suppliers and data transfers: info@detailero.com.