Subverwerkers
Laatst bijgewerkt: 21 oktober 2026
Dit document is alleen beschikbaar in het Engels en het Frans.
Sub-processors · Last updated: 21 October 2026
Purpose
VesyGo uses the sub-processors below to operate hosting, payments, email, notifications, analytics, file storage, the dashboard assistant and automatic translation, support and security services. Each provider is used only to the extent necessary for the stated purpose.
European Union / EEA providers
Hetzner Online GmbH
- Purpose:
- Dedicated server hosting and PostgreSQL database
- Country:
- Germany (registered office) — server in the European Union
- Data:
- Account, salon, customer, booking and invoice data
BulkGate (TOPefekt s.r.o.)
- Purpose:
- SMS delivery: verification code, confirmation, cancellation, reminder
- Country:
- Czechia
- Data:
- Phone numbers; SMS content
OVHcloud (Zimbra)
- Purpose:
- Inbound email handling for platform mailboxes and aliases
- Country:
- France
- Data:
- Received and sent emails
| Provider | Purpose | Country | Data |
|---|---|---|---|
Hetzner Online GmbH Data protection terms: Hetzner Online GmbH | Dedicated server hosting and PostgreSQL database | Germany (registered office) — server in the European Union | Account, salon, customer, booking and invoice data |
BulkGate (TOPefekt s.r.o.) Data protection terms: BulkGate (TOPefekt s.r.o.) | SMS delivery: verification code, confirmation, cancellation, reminder | Czechia | Phone numbers; SMS content |
OVHcloud (Zimbra) Data protection terms: OVHcloud (Zimbra) | Inbound email handling for platform mailboxes and aliases | France | Received and sent emails |
Non-EU providers or providers with possible international transfers
Cloudflare, Inc.
- Purpose:
- CDN, DNS, DDoS protection and domain routing; storage of copies of the database backups (Cloudflare R2)
- Country:
- United States (EU points of presence)
- Data:
- Visitor IP address; HTTP request metadata; Copies of the database backups: all categories of data (account, salon, customer, booking and invoice data)
Upstash, Inc.
- Purpose:
- Managed Redis for rate limiting and short-term storage of verification codes — standby provider, not active today: no data is sent to it
- Country:
- United States (Delaware corporation) — storage region chosen on activation
- Data:
- If activated: phone numbers and email addresses tied to verification codes, IP addresses and account identifiers used for rate limiting
Resend (Plus Five Five, Inc.)
- Purpose:
- Transactional email delivery
- Country:
- United States
- Data:
- Recipient email address and name; Email content
Meta Platforms Ireland Ltd. (WhatsApp Business)
- Purpose:
- WhatsApp Business messages, only where a compatible WhatsApp channel is configured and enabled
- Country:
- Ireland (EU entity) and possible transfers to the United States (Meta Inc.)
- Data:
- Phone numbers; WhatsApp message content
Stripe Payments Europe Limited
- Purpose:
- Deposits and booking payments (Stripe Connect) and subscription billing. Stripe acts as a processor to provide its services, and as a controller for fraud prevention, its own legal obligations and the choice of payment networks (section 2 of its DPA)
- Country:
- Ireland (EU entity) and transfers to the United States (Stripe, LLC)
- Data:
- Owner's email address, salon name, billing address and VAT number (subscription); Email address of the customer paying a deposit, service, team member and appointment time; Card details, entered on Stripe's own page; Stripe identifiers and payment metadata
UploadThing (T3 Tools, Inc.)
- Purpose:
- Storage of images uploaded by salons (logo, cover, gallery, team and service photos)
- Country:
- United States
- Data:
- Images uploaded by salons, including photos of team members
Google LLC
- Purpose:
- Google OAuth authentication, Google Calendar API, Google Place reviews and Google Analytics (audience measurement, anonymised IP, subject to consent)
- Country:
- United States (Google LLC); Ireland for Analytics (Google Ireland Limited) and Google Maps Platform (Google Cloud EMEA Limited), with transfers to the United States
- Data:
- User Google profile; Appointments written to the connected calendar (customer name, service, customer note, appointment location) and events read from that calendar; Anonymised browsing data (Analytics)
Microsoft Corporation
- Purpose:
- Microsoft Graph API (Outlook / Office 365) — calendar synchronisation for team members who connect their Microsoft account
- Country:
- United States
- Data:
- Microsoft profile (name, email); Appointments written to the connected calendar: customer name, service, customer note, appointment location; Events read from that calendar
OpenAI Ireland Ltd.
- Purpose:
- Dashboard assistant (answers to salons' questions), automatic translation of salons' public content and of VesyGo's prospecting messages, suggested services for a trade VesyGo does not know, and reading the photos of price lists that the owner sends (VesyGo does not keep the photos; OpenAI may keep requests for up to 30 days for abuse prevention)
- Country:
- Ireland (EU entity) and possible transfers to the United States
- Data:
- Messages typed into the assistant; Salon configuration (name, city, country, settings, plan and subscription, aggregated booking counts); Public content to translate (description, services, team biographies, booking policy texts, booking form questions, photo descriptions); Name, city, country and business type of prospected businesses; Words describing the trade typed in (no name or email), page language; Photos of price lists sent by the owner (read then deleted, never kept by VesyGo), with the salon's currency, language and trade
Sentry (Functional Software, Inc.)
- Purpose:
- Error and performance monitoring
- Country:
- United States (entity) — data stored in Sentry's EU region (Germany)
- Data:
- Stack traces; Performance measurements and technical metadata (address of the page viewed, browser)
| Provider | Purpose | Country | Data |
|---|---|---|---|
Cloudflare, Inc. Data protection terms: Cloudflare, Inc. | CDN, DNS, DDoS protection and domain routing; storage of copies of the database backups (Cloudflare R2) | United States (EU points of presence) | Visitor IP address; HTTP request metadata; Copies of the database backups: all categories of data (account, salon, customer, booking and invoice data) |
Upstash, Inc. Data protection terms: Upstash, Inc. | Managed Redis for rate limiting and short-term storage of verification codes — standby provider, not active today: no data is sent to it | United States (Delaware corporation) — storage region chosen on activation | If activated: phone numbers and email addresses tied to verification codes, IP addresses and account identifiers used for rate limiting |
Resend (Plus Five Five, Inc.) Data protection terms: Resend (Plus Five Five, Inc.) | Transactional email delivery | United States | Recipient email address and name; Email content |
Meta Platforms Ireland Ltd. (WhatsApp Business) Data protection terms: Meta Platforms Ireland Ltd. (WhatsApp Business) | WhatsApp Business messages, only where a compatible WhatsApp channel is configured and enabled | Ireland (EU entity) and possible transfers to the United States (Meta Inc.) | Phone numbers; WhatsApp message content |
Stripe Payments Europe Limited Data protection terms: Stripe Payments Europe Limited | Deposits and booking payments (Stripe Connect) and subscription billing. Stripe acts as a processor to provide its services, and as a controller for fraud prevention, its own legal obligations and the choice of payment networks (section 2 of its DPA) | Ireland (EU entity) and transfers to the United States (Stripe, LLC) | Owner's email address, salon name, billing address and VAT number (subscription); Email address of the customer paying a deposit, service, team member and appointment time; Card details, entered on Stripe's own page; Stripe identifiers and payment metadata |
UploadThing (T3 Tools, Inc.) Data protection terms: UploadThing (T3 Tools, Inc.) | Storage of images uploaded by salons (logo, cover, gallery, team and service photos) | United States | Images uploaded by salons, including photos of team members |
Google LLC Data protection terms: Google LLC | Google OAuth authentication, Google Calendar API, Google Place reviews and Google Analytics (audience measurement, anonymised IP, subject to consent) | United States (Google LLC); Ireland for Analytics (Google Ireland Limited) and Google Maps Platform (Google Cloud EMEA Limited), with transfers to the United States | User Google profile; Appointments written to the connected calendar (customer name, service, customer note, appointment location) and events read from that calendar; Anonymised browsing data (Analytics) |
Microsoft Corporation Data protection terms: Microsoft Corporation | Microsoft Graph API (Outlook / Office 365) — calendar synchronisation for team members who connect their Microsoft account | United States | Microsoft profile (name, email); Appointments written to the connected calendar: customer name, service, customer note, appointment location; Events read from that calendar |
OpenAI Ireland Ltd. Data protection terms: OpenAI Ireland Ltd. | Dashboard assistant (answers to salons' questions), automatic translation of salons' public content and of VesyGo's prospecting messages, suggested services for a trade VesyGo does not know, and reading the photos of price lists that the owner sends (VesyGo does not keep the photos; OpenAI may keep requests for up to 30 days for abuse prevention) | Ireland (EU entity) and possible transfers to the United States | Messages typed into the assistant; Salon configuration (name, city, country, settings, plan and subscription, aggregated booking counts); Public content to translate (description, services, team biographies, booking policy texts, booking form questions, photo descriptions); Name, city, country and business type of prospected businesses; Words describing the trade typed in (no name or email), page language; Photos of price lists sent by the owner (read then deleted, never kept by VesyGo), with the salon's currency, language and trade |
Sentry (Functional Software, Inc.) Data protection terms: Sentry (Functional Software, Inc.) | Error and performance monitoring | United States (entity) — data stored in Sentry's EU region (Germany) | Stack traces; Performance measurements and technical metadata (address of the page viewed, browser) |
Changes
VesyGo may update this list when providers are added, replaced or removed. Material changes will be communicated where required by applicable law or contract.