Sub-Processor List
Last updated: 2026-08-07
The following entities process personal data on our behalf under a Data Processing Agreement (DPA). The list is updated whenever it materially changes; existing tenants receive 30 days' advance notice before a new sub-processor is activated.
| Sub-Processor | Purpose and Scope of Processing | Data Categories | Processing Location | Transfer Safeguard | Documents |
|---|---|---|---|---|---|
Neon, Inc. | PostgreSQL database hosting (primary application store) | user account, bookings, payments, communications | EEA | within the EEA — no transfer | |
Upstash, Inc. optional | Redis cache (sessions, rate-limit counters, idempotency keys, locks) | user account | EEA | within the EEA — no transfer | |
Comgate Payments, a.s. | Payment processing and recurring (subscription) charges | payments, user account | Czech Republic | within the EEA — no transfer | |
Twilio Inc. optional | SMS notification delivery (booking reminders, transactional codes) | user account, communications | United States | Standard Contractual Clauses 2021/914 | |
OpenAI, OpCo, LLC optional | AI-assisted text generation for reminder and follow-up e-mails | bookings, communications | United States | Standard Contractual Clauses 2021/914 | |
Have I Been Pwned (Superlative Enterprises Pty Ltd) optional | k-anonymity password breach lookup — only the first 5 characters of a SHA-1 hash are sent | security | United Kingdom | UK adequacy decision | |
SMTP provider optional | Transactional and notification e-mail delivery (provider configured per deployment via SMTP_HOST) | user account, communications | operator-configured | depends on operator configuration | — |
If you need a signed copy of the DPA or additional information on a specific sub-processor, contact us at privacy@schedulebox.cz.