Sub-processors
Last updated 2026-07-29
The third parties StillOpen engages to process personal data on its behalf, what each one handles, and where it operates.
1.How to read this list
StillOpen uses the vendors below to run parts of the service. Each is engaged under a written agreement that binds it to process personal data only on our instructions, to apply appropriate security measures, and — where the transfer leaves the EEA or the UK — to the European Commission’s Standard Contractual Clauses.
The first table lists the vendors involved in every StillOpen account. The second lists vendors engaged only when a business turns on the feature they power; if a business never enables SMS, never uses the voice receptionist and never offers virtual services, those vendors never see its data.
This list applies both to the data StillOpen holds as controller (business accounts) and to the data it processes on behalf of businesses (their customers’ bookings). See the Privacy Notice for the distinction.
2.Core sub-processors
Engaged for every account.
| Sub-processor | What it does | Data involved | Location |
|---|---|---|---|
| Supabase | Database, authentication and file storage — the primary system of record for every account, booking and uploaded asset. | All account, business, staff, customer, booking and payment-metadata records; uploaded logos, covers and gallery images. | EU (Frankfurt, eu-central-1) by default; US or APAC where a business has pinned that region. |
| Vercel | Application hosting, edge routing and serverless functions — every page and API request is served here. | Request metadata in transit: IP address, user-agent, URL, cookies. Server logs. | Global edge network with EU regions. |
| Stripe | Subscription billing for StillOpen plans, and Stripe Connect so businesses can take payments, deposits, gift cards and tips from their customers. | Cardholder and payment data (collected by Stripe directly, never by StillOpen), billing contact details, and connected-account identity and bank details supplied during Express onboarding. | Global. PCI-DSS Level 1 certified. |
| Resend | Transactional email delivery — booking confirmations, reminders, cancellations, receipts, invoices, welcome and payment-failure notices. | Recipient name and email address, and the contents of the message. | United States. EU-US Data Privacy Framework. |
| Anthropic | AI text generation behind theme and page generation, the dashboard copilot, the booking-page concierge and marketing content. | The prompt content for the feature in use — page copy, brand settings, service lists, and concierge conversation text. | United States. |
3.Feature-dependent sub-processors
Engaged only when the feature they power is switched on for a particular business.
| Sub-processor | What it does | Data involved | Location |
|---|---|---|---|
| Sentry | Server and browser error monitoring. | Exception messages and stack traces, request URL, user-agent, and the account identifier associated with an error. | United States / EU. |
| Cloudflare | Turnstile bot protection on the signup form and other public forms. | IP address, user-agent and challenge-response token. | Global. |
| Twilio | SMS and WhatsApp notifications, inbound booking by text, and phone numbers for the voice receptionist. | Recipient phone number and message contents; call metadata. | Global. |
| Vapi, Retell or ElevenLabs | AI voice receptionist that answers calls and books appointments. A business's chosen provider is engaged only for that business. | Call audio, transcripts, caller phone number, and the booking details discussed. | United States. |
| Whereby, Zoom or Google | Meeting rooms for virtual and online services. Whereby rooms are created automatically; Zoom and Google Meet are connected by the business through OAuth. | Meeting room details, participant names and email addresses, and — where the provider records or transcribes — that content. | EU (Whereby) or United States (Zoom, Google). |
| Replicate, Stability AI or OpenAI | AI image generation in the appearance editor, for covers, link previews, avatars and gallery images. | The image prompt and any source image supplied by the business. | United States. |
| GitHub | Opening an issue from a report submitted on our contact page, so the report reaches engineering. | The contents of the report and the contact details included in it. | United States. |
| Meta, Gumroad or Lemon Squeezy | Social publishing and creator-monetisation connections a business chooses to link to its account. | OAuth tokens and the account profile the business authorises, plus the content it chooses to publish. | Global. |
4.StillOpen personnel
Our own team accesses personal data only where it is needed to run and support the service, under confidentiality obligations and least-privilege access controls. Privileged actions are written to an audit log.
5.Changes to this list
Before a new sub-processor starts processing personal data we notify business owners by email at the address on their account. Owners have 14 days to object on reasonable data-protection grounds. If we cannot resolve an objection, the owner may cancel their subscription without penalty for the remainder of the paid period.
To be added to the notification list, to ask about a specific vendor, or to request a copy of the Data Processing Agreement, email legal@stillopen.app.