Sub-processors

Everyone who can process tenant data on our behalf, and why. This document forms part of the Data Processing Addendum. We give 30 days notice in the product and by email before adding a sub-processor, and you may object on reasonable data protection grounds. A provider you connect on your own account — a payment gateway, an SMS gateway, WhatsApp, Viber or a carrier — is not on this list: it is your processor, engaged under your own contract with it, and we pass it only what you send through it.

DigitalOcean, Germany (Frankfurt) — application hosting, the database, the job queue and file storage, and backups within the same region. Cloudflare, EU edge — CDN, DNS and web application firewall; it terminates TLS and therefore sees request metadata, but no application data is stored at the edge. Sentry, EU — error reports from the apps and the server; a report can carry the address of the page or request that failed, and we do not send it message text or client records on purpose. Google Maps Platform, United States — places a business on the map: it turns the address a salon enters into map coordinates, which we keep for at most 30 days before looking them up again, and draws the maps in Setvos and its phone apps. It receives the address being placed and, when a map is shown, the viewer’s IP address and the area of the map in view. From the date given in our notice, where a business visits clients at home and has set the area it covers, it also checks that the address of such a visit lies inside that area: it receives the street, house and town, never the client’s name or phone number, and the point it returns is used for that check and not kept. We send it no other client records.

LiqPay and monobank, Ukraine — card payments for your Setvos licence in hryvnia made before we stopped taking hryvnia cards, and their refunds: they hold that card data, and we keep a transaction reference, never the card number. A licence in hryvnia is now paid by bank transfer. Paddle, United Kingdom — card payments for your licence in euros and dollars, which Paddle sells as merchant of record: for those purchases it is the seller and holds your payment details as a controller in its own right, and we receive the transaction and subscription references. Checkbox, Ukraine — our own ПРРО, which receives the owner’s email address to deliver the fiscal receipt for each hryvnia payment of your licence our register files a receipt for. The gateway you connect to take your own clients’ payments — LiqPay, Fondy or monobank — works on your own merchant account and is your processor.

TurboSMS, Ukraine — the SMS we send on our own account: reminders and confirmations within your allowance, and the codes that confirm a client’s phone number. SMSAPI, Poland, and seven.io, Germany — gateways that may carry the texts we send on our own account to numbers outside Ukraine. SMSAPI also carries a text to a Ukrainian number when TurboSMS cannot. Brevo, EU — email: sign-up, password reset, booking confirmations and invoices. Expo, United States — push notifications to the phone apps; it receives the device’s push token and the notification’s text. Each receives only the recipient’s number, address or device token and the message content needed to deliver it. WhatsApp, Viber and an SMS gateway you connect yourself — TurboSMS, AlphaSMS, SMSClub, Twilio, SMSAPI or seven.io — run on your own account and are your processors, not ours.

None of ours. Nova Poshta, Ukrposhta and Meest work on your own account with the carrier and are your processors: they receive the recipient’s name, phone number and destination branch for the orders you choose to ship.

Anthropic, EU and US — the optional AI features (a record brief, a drafted reply, a proposed import mapping). This one is different from every other entry here: it processes nothing at all unless a workspace owner turns AI on in Settings, and it then receives only the single record or conversation somebody asked about, never your client base. The contract prohibits training on it and retains nothing for training.

No sub-processor receives your client base for its own purposes, and none is permitted to use tenant data for advertising, resale, profiling or model training. Those restrictions are in each contract, not just in this document.