This page forms part of the Data Processing Addendum and satisfies its section 6. It lists every provider we entrust with your clients' personal information, what each does, and where each processes it.
It is kept apart from the addendum for one reason: the list changes more often than the terms do, and changing an email provider should not mean re-reading twelve sections.
How this list changes
We give at least 30 days' notice by email to the address on your account before adding or changing a sub-processor. You may object on reasonable grounds within that period, and if the objection cannot be resolved you may terminate immediately and require deletion of your data, at no cost. Section 6 of the addendum sets out the procedure.
Sub-processors
| Provider | Role | Where it processes |
|---|---|---|
| Google Ireland Limited (Google Cloud) | Runs the application, the booking pages and this website, holds the database, stores configuration | Belgium, region europe-west1 |
| Brevo SAS | Delivers email to your clients | France |
All processing is in the European Union. Nothing is stored in the United States. That is the point worth reading twice, because it is the opposite of what most US buyers assume about a scheduling tool, and it is why section 7 of the addendum needs Standard Contractual Clauses for the flow back to you rather than for the flow to us.
There is no SMS provider on this list, and its absence is deliberate. The gateway that serves other markets runs in its provider's Irish region, which carries no +1 numbers at all, so US accounts send email only. Section 2 of the terms says so and explains why.
Providers that are not sub-processors of client data
Listed because they are visible from outside and the question is a fair one. The answer is that none of them has access to your clients' data.
| Provider | What it does | Why it is not a sub-processor |
|---|---|---|
| Google Ireland Limited (Firebase Authentication) | Signs in the people who work at your practice | Processes the staff email address and account identifier, never a client's data. We are the controller of that information rather than your processor, so it falls outside this addendum |
| Google (Google Ads) | Counts accounts opened from an ad, only after consent in the banner | An independent controller, not our subprocessor. Never loads on booking pages or in the application. Section 9 of the privacy notice has the detail |
| Paddle.com Market Limited | Bills your subscription: payment, invoice and tax | Processes your practice's billing details - name, address, tax identifier and card - never a client's data. Paddle has no access to the application or its database. As the merchant of record it is a controller of that information in its own right rather than our sub-processor, so it falls outside this addendum |
The distinction between the first row of this table and the first row of the table above is deliberate: the same provider appears in two roles, once as a sub-processor of client data and once as the sign-in service for your staff.
Changes in version 1.2: the subscription payment provider was added. The thirty days' notice does not apply here, because it attaches to sub-processors of client data and Paddle is not one — it has no access to any client's data. It is listed in the second table above because the question about it is a fair one.