Legal
Subprocessors
Status — drafted, pending legal review · last updated
This is a draft published for review. It is not a binding agreement, and the operator's counsel has not approved it.
This document is not yet in force because Bookesto has no customers and no deployed service. What is stated below is our intended position, published early so that it can be read before there is anything to agree to. It will be replaced by a reviewed and dated document before the first account is created.
Who else touches the data
Every third party that processes data on our behalf, what it is used for, and where it runs.
| Subprocessor | Purpose | Data | Region |
|---|---|---|---|
| Hetzner Online GmbH | Hosting and backups | All application data | Germany or Finland, stated per deployment |
| Stripe | Payment processing | Payment metadata. Card data never reaches Bookesto | Ireland / United States, per Stripe's terms |
| 360dialog GmbH | WhatsApp Business API access | Message content and phone numbers for WhatsApp only | Germany |
| Meta Platforms Ireland | WhatsApp message delivery | Message content and phone numbers for WhatsApp only | Ireland |
This list is complete as of
Notice, not discovery
We publish subprocessor changes on the changelog before they take effect, so that a customer has notice rather than a discovery.
The security position behind this list — what is implemented, what is not started, and the trigger for each — is at /security.
Questions: legal@bookesto.com. Changes to any of these documents are published on the changelog before they take effect.