Sub-processors
Last updated: 23 September 2026
yasi as uses these suppliers to deliver Yasi; each processes personal data only for the purpose stated. Suppliers outside the EU/EEA are covered by the EU–US Data Privacy Framework (DPF) and/or Standard Contractual Clauses. Locations were verified on 23 September 2026.
| Sub-processor | Purpose | Data involved | Location |
|---|---|---|---|
| Supabase | Database and file storage | All customer data | EU — Frankfurt, Germany (AWS eu-central-1) |
| Render | Backend application hosting | All customer data while processed | EU — Frankfurt, Germany |
| Vercel | Web application hosting (dashboard, booking pages, widget) | Data shown to signed-in users; booking-form input in transit | Global edge network; US company (DPF) |
| Clerk | Sign-in for venue owners and dashboard users | Names, emails, credentials, sessions | USA (DPF) |
| Resend | Email delivery (booking messages, campaigns sent by the venue) | Guest and user names, email addresses, message content | EU — Ireland (AWS eu-west-1); US company (DPF) |
| Twilio | WhatsApp channel | Guest phone numbers, message content | USA (DPF) |
| OpenAI | AI processing for the guest concierge and venue assistant | Conversation content sent to the concierge; venue content used to draft replies | USA (DPF); no training on API data |
| Sentry | Error monitoring | Technical error reports; may include a user id or venue id, never message content | EU — Germany |
| Google (Firebase Cloud Messaging) | Push notifications to Android apps | Device push tokens | USA/global (DPF) |
| Apple (APNs) | Push notifications to iOS apps | Device push tokens | USA/global (DPF) |
| SerpAPI, Outscraper | Fetching a venue's public reviews for analysis | Public review text and reviewer names as published online; no guest data | USA (DPF / SCC) |
Planned and added here before go-live: Stripe (subscription billing; venue billing contact and card token; EU/US, DPF). Domeneshop (Norway) hosts our company email but does not process customer data.
We update this page at least 30 days before adding or replacing a sub-processor. Questions: privacy@getyasi.com.