Version SUBPROCESSORS-2026-10-v4 · As of 28 October 2026
Subprocessors
This list is an annex to the Data Processing Agreement (https://tavelo.ch/dpa). It names the providers that process personal data on Tavelo's behalf. We inform restaurants at least 30 days in advance of new or replaced subprocessors.
This English version is a convenience translation. The German version is legally controlling; in case of any conflict, the German version prevails.
1. Subprocessors
| Provider | Purpose | Data | Location / transfer | Agreement |
|---|---|---|---|---|
| Supabase (contracting entity: Supabase Pte. Ltd, Singapore) | Database, sign-in, file storage | All data stored in Tavelo (accounts, orders, reservations, loyalty and marketing data, Wallet identifiers, billing, images) | Stored in the EU: Supabase region Central EU (Frankfurt, AWS eu-central-1), Germany. The contracting entity is based in Singapore; any transfer (e.g. access by the provider) is based on the EU standard contractual clauses with Swiss adaptations (per Supabase DPA) | https://supabase.com/legal/dpa |
| Vercel Inc., USA | Hosting of the website and server functions | All data transmitted through the app; IP addresses and request logs | Server functions in the US (region iad1); delivery via Vercel's global network. Transfers based on the EU standard contractual clauses (per Vercel DPA) | https://vercel.com/legal/dpa |
| Resend (Plus Five Five, Inc.), USA | Sending reservation emails and one-time codes | Email address, name, reservation details, restaurant name, one-time code | Primary processing in the US. Transfers based on the EU standard contractual clauses with Swiss adaptations; Resend is certified under the Data Privacy Framework (per Resend DPA) | https://resend.com/legal/dpa |
| Amazon Web Services EMEA SARL, Luxembourg (Amazon SES) | Sending emails (reservations, one-time codes, contracts) | Email address, name, email content (e.g. reservation details, restaurant name, one-time code) | Sent from the AWS region eu-central-1 (Frankfurt), Germany. Any transfer (e.g. access by the provider or its affiliates in the US) is based on the EU standard contractual clauses with Swiss adaptations (per AWS DPA) | https://d1.awsstatic.com/legal/aws-dpa/aws-dpa.pdf |
| OpenAI (for EEA / Swiss data: OpenAI Ireland Limited) — only where AI features are enabled | AI reservation assistant, translation of menu texts and order notes, text recognition when a menu is imported from photos or a PDF | Typed chat text (no contact details), menu texts, order notes, photos of printed menus or page images of a menu PDF (not stored by Tavelo; not intended to contain personal data) | Processing also outside Switzerland, including the US. Transfers based on standard contractual clauses (per OpenAI DPA). Tavelo sends requests with the setting not to store responses with the provider; OpenAI may retain API data for a limited period under its terms, e.g. for abuse detection | https://openai.com/policies/data-processing-addendum/ |
2. Independent providers (not subprocessors)
Apple (Apple Wallet) and Google (Google Wallet) provide the Wallet apps a guest uses themselves. Tavelo sends them the loyalty card content when a guest adds a card, and sends updates. Apple and Google act under their own terms and privacy policies (https://www.apple.com/legal/privacy/, https://policies.google.com/privacy). Whether Google acts as a processor for card objects stored in Tavelo's issuer account is still under legal review.
GitHub triggers scheduled background jobs and receives no personal data.