Current subprocessors
| Provider | Purpose and data | Where and safeguard |
|---|---|---|
| Fly.io Fly.io, Inc. (USA) | Application hosting: runs the web app and background jobs. All service data while it is processed; server logs (IP address, request path). Used: Always. | Frankfurt, Germany (region fra). EU–US Data Privacy Framework; standard contractual clauses (Fly.io DPA). |
| Supabase Supabase, Inc. (USA), on Amazon Web Services | Database hosting. All service data (accounts, organisations, bookings, logs), encrypted at rest. Used: Always. | Frankfurt, Germany (AWS eu-central-1). EU standard contractual clauses with the UK Addendum (Supabase DPA). |
| Tigris Tigris Data, Inc. (USA) | File storage and the nightly database backup. Uploaded floor plans, icons and profile pictures; the nightly database backup. Used: Always. | Tigris global object storage, written from Frankfurt. Standard contractual clauses (Tigris DPA). |
| GitHub GitHub, Inc. (USA) | Runs the nightly backup job that copies the database to storage. The database backup, while the job runs. Used: Always. | USA. EU–US Data Privacy Framework and UK extension; standard contractual clauses. |
| Cloudflare Cloudflare, Inc. (USA) | DNS, forwarding of email sent to our addresses, and the Turnstile bot check on public forms. IP address and browser signals (bot check); emails you send us. Used: Always. | Global network. EU–US Data Privacy Framework and UK extension; standard contractual clauses. |
| Resend Plus Five Five, Inc. (Resend, USA) | Sending emails (sign-in links, invitations, booking emails). Name, email address and the email's content. Used: Always. | USA. EU–US Data Privacy Framework and UK extension; EU standard contractual clauses with the UK Addendum (Resend DPA). |
| Stripe Stripe Payments Europe Ltd / Stripe Payments UK Ltd, with Stripe, Inc. | Subscription billing and payments. Billing contact, billing address, VAT number, payment card details (held by Stripe). Used: Paid plans. | EU, UK and USA. EU–US Data Privacy Framework and UK extension; standard contractual clauses (Stripe DPA). |
| tawk.to tawk.to inc. | Live chat on the public website. Chat messages, any name or email you give, IP address and browser details. Used: Only on the public website, and only if you accept optional cookies. | USA and other countries. EU–US Data Privacy Framework and UK extension; EU standard contractual clauses with the UK Addendum (tawk.to DPA). |
| Sentry Functional Software, Inc. (USA) | Error monitoring. Technical error reports with an opaque user and organisation ID (no names or email addresses). Used: When error monitoring is switched on. | USA. EU–US Data Privacy Framework and UK extension; standard contractual clauses (Sentry DPA). |
| Plausible Plausible Insights OÜ (Estonia) | Cookie-free visitor statistics. Page views; IP address used only to count unique visitors, never stored. Used: Only if switched on, and only if you accept optional cookies. | EU. Processed in the EU. |
How we tell you about changes
- We email every organisation's owners at least 30 days before a new subprocessor starts processing customer data, and add it to the history below.
- Anyone can follow changes with the subprocessor feed (Atom).
- Customers can object on reasonable data protection grounds before the change, by emailing hello@getdanno.com; see clause 4 of the addendum.
Change history
- Removed Anthropic: the AI assistant was withdrawn and nothing sends it data any more.
- First published list: Fly.io, Supabase, Tigris, GitHub, Cloudflare, Resend, Stripe, Anthropic, tawk.to, Sentry and Plausible.
Services people connect
These are not our subprocessors: they act for the person who connects them, under their own terms.
- Google: Sign in with Google; adding your bookings to Google Calendar. Your name, email address and profile picture from Google; the bookings we add to your calendar.
- Microsoft: Sign in with Microsoft; adding your bookings to Outlook. Your name and email address from Microsoft; the bookings we add to your calendar.
- OpenStreetMap: Map tiles and address search on location pages. Your browser's IP address and the address typed into the search.