Sub-processors
Last verified: 28 October 2026.
This list belongs with the privacy policy and Annex C of the data processing agreement. A customer has the right to object to a new sub-processor, so adding a party is a change customers are told about in advance.
| Party | Processing | Location | Transfer basis |
|---|---|---|---|
| Supabase | Database, authentication, document storage | EU (Sweden, Stockholm) | n/a |
| Vercel | Application hosting | EU (Sweden, Stockholm) | n/a |
| Resend | Sending email | EU | n/a |
| DeepL | Translating instructions and messages | EU | n/a |
| Stripe | Payments and billing | Not yet established | Not yet established |
| OpenAI | Transcribing voice messages (switched off today, see below) | United States | Standard Contractual Clauses |
| Google (Firebase Cloud Messaging) | Delivering notifications in the Android app: per notification the title, text, in-app link and label, plus the installation's registration number (token) | Worldwide, including the United States | EU-U.S. Data Privacy Framework; otherwise Standard Contractual Clauses (Firebase data processing terms) |
Vercel's edge network is global. The static marketing pages can be cached closer to the visitor, including outside the EU. Those pages hold no personal data — they are sales copy. The application, all data and all logic run in Stockholm.
OpenAI is not used today. Speech-to-text is switched off, so nothing goes to OpenAI. The row above exists so the basis is already in place for the moment a customer turns that feature on. A customer who never wants that stays within the EU for speech regardless: an EU alternative is available.
Google (Firebase Cloud Messaging). Only for the Android app, and only for people who turn on notifications there themselves. Google can read the title and text of such a notification; it can contain a destination, a trip reference, a driver's name or a short part of a message or note, but never the recipient's name or email address. Google keeps an undelivered notification for at most 4 weeks, and deletes a revoked registration number within 180 days. Analytics (Google Analytics) is switched off. Notifications in the browser do not go through Firebase but through Web Push: they are encrypted for the device and the browser's push service cannot see the content.