ALWAYS IN USE
Infrastructure
The database, hosting, network protection and email that every request and record passes through.
Process data only to provide their service to Owneli
LEGAL · SUB-PROCESSORS
Sub-processors.
Who handles personal information for Owneli, what each receives, and where.
Last updated 6 November 2026Applies to the Owneli platform, its apps, and the booking pages it hosts
Two kinds of provider.
WHEN A FEATURE IS IN USE
Features
Payments, messages, AI, notifications, error reports and sign-in, each used only for the feature it serves.
Several run only where a business or an administrator switches the feature on
Jump to a section
SECTION 01
Always in use
The infrastructure every request and record passes through.
| Provider | What it does for Owneli | What it receives | Where |
|---|---|---|---|
| Supabase | Database, sign-in and file storage | Every record a business keeps on Owneli, sign-in accounts, and uploaded files and photographs | United States: Amazon Web Services, northern Virginia |
| Vercel | Hosting the application and running its scheduled jobs | Every request as it is served, and the operational logs that come with it | United States: Washington, D.C. |
| Cloudflare | Network protection in front of the platform, and a bot check on online booking when unusual activity is detected | Every request before it reaches us: the address it comes from, the page asked for and the browser string. When the bot check is shown, the signals it reads from the browser to tell a person from an automated program | Cloudflare’s worldwide network |
| Resend | Email delivery | Recipient address and name, subject, message, any attachment, and delivery, bounce, open and click events | The provider’s own regions, under its data processing terms |
SECTION 02
Used when a feature is in use
Each of these runs only for the feature it serves, and several only where a business or an administrator has switched that feature on.
| Provider | What it does for Owneli | What it receives | Where |
|---|---|---|---|
| Stripe | Card payments, saved cards, payouts to businesses, disputes, and Owneli’s own billing | Cardholder name, email address, amounts and the identifiers linking a payment to a business and a client. Card numbers go from the payer’s device to Stripe directly. A business’s identity and bank details go to Stripe directly when it sets up payouts. | The provider’s own regions, under its data processing terms |
| Twilio | Text and WhatsApp messages, and the verification code sent when someone registers or accepts a staff invitation | The recipient’s mobile number, the sending number, the message text and replies; for a business’s own texting line, the business details and named contact needed to register it with phone carriers | The provider’s own regions, under its data processing terms |
| Meta (WhatsApp Business Platform) | WhatsApp messages, for a business that connects its own WhatsApp number | The recipient’s WhatsApp number, the business’s WhatsApp number and display name, the message text and replies | The provider’s own regions, under its data processing terms |
| Google (Gemini API) | AI features: the Oryx assistant, drafting, import column matching and voice transcription, when an administrator has switched them on; and the search index of a business’s own authored material and our help articles | The question and the records fetched to answer it, attached files, dictated audio for the length of the request, and authored material for the index. Never clinical charts. | The provider’s own regions, under its data processing terms |
| Anthropic | AI features, where a deployment is configured to use it | The same as Google for the AI features it serves | The provider’s own regions, under its data processing terms |
| Sentry | Error reports and scheduled-job monitoring, where a deployment has a reporting key | The technical shape of a failure, with credentials, contact details and clinical fields removed first | European Union |
| Apple | Notifications in the iPhone apps | The device token of a phone with notifications on, and each notification’s title, text and the screen it opens | The provider’s own regions, under its data processing terms |
| Google (Firebase Cloud Messaging) | Notifications in the Android apps | The device token of a phone with notifications on, and each notification’s title, text and the screen it opens | The provider’s own regions, under its data processing terms |
| Google, Mozilla, Apple, Microsoft | Browser notifications, through whichever of them the browser uses | An encrypted notification title, body and link | The provider’s own regions, under its data processing terms |
| Google (Sign in with Google) | Signing in with a Google account, for someone who chooses it | Google sends us the person’s name, email address, profile picture link and Google account identifier | The provider’s own regions, under its data processing terms |
| Google (Google Analytics) | Visit counts on Owneli’s own website, only after a visitor allows it | The page address without its query string, the page that sent the visitor, the browser and device, and an approximate location from the IP address | The provider’s own regions, under its data processing terms |
SECTION 03
What is not on this list
Services a business chooses for itself, and services a visitor’s browser contacts directly, are not Owneli’s sub-processors.
- A business’s own measurement on its booking pages, when it switches conversion tracking on: its Google Analytics, Google Ads and Meta accounts. The business decides to use them and answers for them.
- A business’s own video meeting room (Google Meet, Zoom or Teams) for video appointments. Owneli stores and sends the link; the call happens on that service.
- Services a browser fetches from directly on some pages: typefaces from Google Fonts on brand-themed pages, the map from OpenStreetMap on a venue page, Stripe’s payment form where a card is taken, and Google’s sign-in button where Google sign-in is offered.
SECTION 04
Changes, and questions
The date at the top is the version of this list.
This list changes when a provider is added or removed, and the date at the top changes with it. The privacy policy describes what each kind of information is used for, how long it is kept and the rights people have over it.
How this information is used
The privacy policy explains what each kind of information is for, how long it is kept and how to use your rights.