These companies process personal data for us. Each operates under a Data Processing Agreement. Where a company is outside the UK, the country and the safeguard that protects your data are shown.
- Supabase — database, authentication, file storage (EU — Ireland)
- Stripe — payment processing and subscription billing (USA — Standard Contractual Clauses)
- Resend — transactional email delivery (USA — SCCs)
- Twilio — SMS: one-time passwords for client verification, and booking texts sent on behalf of your artist (USA — SCCs)
- Upstash — Redis rate limiting; stores anonymised IP counters only (EU — Ireland)
- Netlify — web hosting (USA — SCCs)
- Railway — API backend hosting (USA — SCCs)
- PostHog — product analytics, configured in consent-gated mode (USA — SCCs)
- Mixpanel — marketing analytics: which of our links and ads lead to signups. Consent-gated; our project is hosted in the EU.
- Meta — measuring our own advertising through the Meta Pixel and Meta's Conversions API. Consent-gated (see section 5).
- Sentry — error monitoring; may include user ID in stack traces (USA — SCCs). We do not record sessions or screens.
- RevenueCat — manages in-app subscriptions on iOS: it receives your account ID and the purchase receipt from Apple to tell us whether your subscription is active (USA — SCCs)
- Cloudflare Turnstile — bot protection on our public forms (sign-up and booking enquiries): it checks your browser and IP address to tell people from automated scripts (USA / global — SCCs)
- Apple Push Notification service (APNs) — iOS push notifications
We do not share data with other third parties except the providers listed here.