Sub-processors
Last updated: 2026-09-25
This page lists the sub-processors Flabio relies on to provide the platform, under Articles 28 and 30 GDPR. It is the authoritative list referred to by our legal documents (tenant DPA, tenant privacy policy, customer privacy policy, agent privacy policy).
Additions and changes are notified to tenants by email at least 30 days in advance and published here. Within that period a tenant may object, stating specific data-protection grounds.
| Sub-processor | Service | Location | Transfer | DPA |
|---|---|---|---|---|
|
Stripe Payments Europe Ltd. / Stripe Inc.
Payment processing, KYC/AML, payouts to stores, Stripe Tax calculation
|
Payments, Stripe Connect, Stripe Tax | Ireland + United States | SCC + EU-US Data Privacy Framework | Open → |
|
Cloudflare Inc.
Minisite asset delivery, DDoS protection, TLS termination, custom hostnames for tenant domains
|
CDN, DNS, custom hostname SSL, anti-bot | United States (global servers, EU first) | SCC + EU-US Data Privacy Framework | Open → |
|
Hetzner Online GmbH
Application servers, MySQL databases, file storage
|
Hosting of the application and database infrastructure | Germany | Intra-EU (no transfer outside the EU) | Open → |
|
TeamSystem S.p.A. (Fatture in Cloud)
Invoice issuing, SDI transmission, cross-app invoice numbering
|
Electronic invoicing and SDI handling | Italy | Intra-EU | Open → |
|
Amazon Web Services EMEA SARL (SES)
Sending transactional emails (account verification, password reset, invoices, notifications)
|
Transactional email (if enabled) | Luxembourg + EU/USA processing | SCC + EU-US DPF | Open → |
|
Mailgun Technologies, Inc.
Sending transactional emails (alternative to SES)
|
Alternative transactional email (if enabled) | United States | SCC + EU-US DPF | Open → |
|
Functional Software, Inc. (Sentry)
Collection of stack traces and application error context (PII scrubbing enabled)
|
Application error monitoring | United States | SCC + EU-US DPF | Open → |
|
DeepL SE
Automatic translation of section names, dishes, descriptions — menu texts only, no personal data
|
Automatic translation of menu texts | Germany | Intra-EU (no transfer outside the EU) | Open → |
|
Anthropic PBC (Claude API)
Photos or PDF of the printed menu, turned into a draft the venue owner reviews (Premium feature, started by the owner); menu texts to be reviewed after automatic translation. Menu content only, no personal data; photos are deleted as soon as the draft is confirmed or discarded; data sent via API does not train the models
|
Reading the photographed paper menu and reviewing translations | United States | SCC + EU-US DPF | Open → |
|
Google Cloud EMEA Limited
Geocoding of store addresses (if the Tenant enables the integration)
|
Maps API (if enabled by the Tenant) | Ireland + United States | SCC + EU-US DPF | Open → |
|
BlueStarSystem (Umami — analytics self-hosted)
Aggregate visit counts on minisites and panels: page, host, referrer, language, device type. No cookies, no IP address kept, no user profile
|
Usage statistics, without cookies | Italy (BlueStarSystem infrastructure) | No transfer (EU on-premise) | Open → |
Security measures that apply throughout
- All transfers outside the EU are made on the basis of Standard Contractual Clauses (EU Decision 2021/914) and, where applicable, the EU-US Data Privacy Framework.
- Every sub-processor is bound by a data processing agreement imposing security and privacy obligations at least equivalent to those in our own DPA with the tenant.
- Flabio shares with each sub-processor only the data strictly necessary for the stated purpose (data minimisation).
Contact
For questions about sub-processors, or to exercise your rights under the GDPR: dpo@flabio.com
This page is public record-keeping information under Article 30 GDPR. It is neither a DPA nor a contract: for the full contractual terms see the legal documents published in the admin panels.