Sub-processors
Part of our Privacy Policy (Section 5)
These are the third parties that process personal data on our behalf to run WellnessDesk. This page and Section 5 of the Privacy Policy are generated from the same list. Each sub-processor may only process the data to provide its service to us.
| Sub-processor | Purpose | Data | Location | Safeguard |
|---|---|---|---|---|
| Google Cloud Platform | Application hosting, database and file storage | All account, booking, client and uploaded-file data held in the Service | europe-southwest1 region (Madrid, Spain) | Data stays in the European Union; Google Cloud data processing terms |
| Stripe, Inc. | Payment processing and payouts | Payer name and email, payment and payout details | United States and European Union | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Postmark | Delivery of transactional emails (booking confirmations, reminders, account verification) | Recipient name and email address, and the content of the email | United States | Standard Contractual Clauses in the provider's data processing terms |
| Twilio | Delivery of text-message reminders, only to Clients who opt in to them | Mobile phone number and the reminder text | United States | Standard Contractual Clauses in the provider's data processing terms |
| Cloudflare | Domain registration and DNS for custom domains a Provider chooses to buy or connect | Domain name and the registrant contact details the Provider enters | United States | Standard Contractual Clauses in the provider's data processing terms |
| Google (sign-in and Calendar) | Google sign-in (OAuth) and Google Calendar sync if you connect it | Name, email address and profile picture; calendar events needed to sync bookings | United States | Standard Contractual Clauses in the provider's data processing terms |
| Google Analytics and Google Ads | Website analytics and ad conversion measurement on our marketing pages (see Section 7) | Pages visited, device and browser information, approximate location and advertising identifiers; only after you accept the cookie banner, never on booking pages or the client portal | United States | Your consent, withdrawable in the cookie banner; Standard Contractual Clauses in the provider's data processing terms |
| Daily.co | Video for online sessions. Calls are not recorded or transcribed. Each video room is private to one session: the Provider and the Client each join with a personal link that stops working shortly after the session ends. | Live audio and video of the session (passed through, not recorded or stored), participant first names, IP address and device details, and when each participant joined and left | Call audio and video go through Daily servers in Frankfurt, Germany (European Union); Daily, Co. is based in the United States, where it keeps call logs | Daily's Data Processing Addendum, part of its terms of service, with the European Commission's Standard Contractual Clauses |
Questions about this list: privacy@wellnessdesk.pro.