Sub-processors
Every third party that processes personal data on our behalf, with country, role, transfer mechanism, and DPA link.
Transfer-mechanism legend
Adequacy = UK adequacy regulation covers the destination (EEA member states). No additional mechanism needed.
DPF UK Ext. = UK Extension to the EU–US Data Privacy Framework; recipient self-certified on the active DPF list.
UK IDTA = UK International Data Transfer Agreement (or UK Addendum to EU SCCs) signed with the recipient, plus a Transfer Risk Assessment on file.
Pending = We are still confirming the mechanism or have requested an updated agreement.
Infrastructure & storage
| Processor | Role | Country | Mechanism | DPA |
|---|---|---|---|---|
| Hetzner Online GmbH | Production + staging server hosting; primary Postgres database | Germany | Adequacy | Standard Auftragsverarbeitungsvertrag |
| Cloudflare, Inc. | R2 object storage (image storage, encrypted DB backups); edge CDN | USA (R2 EU region for our buckets) | DPF UK Ext. | Customer DPA |
Authentication
| Processor | Role | Country | Mechanism | DPA |
|---|---|---|---|---|
| Google LLC (Firebase Authentication) | Email + Google + Apple sign-in; password handling; ID-token verification | USA | DPF UK Ext. | Firebase DPA |
| Apple, Inc. (Sign in with Apple) | Authentication via Apple ID | USA | UK IDTA | Apple Enterprise data-transfer template |
| Klipy (KIKLIKO, Inc. / klipy.com) | GIF search & provision for the in-app group chat (emoji & GIF reactions). When you open the GIF picker your search text, IP address and device/user-agent reach Klipy and its content CDN; we force a ‘G’ safe rating server-side. | USA | UK IDTA | Data Processing Agreement being finalised |
Analytics & observability
| Processor | Role | Country | Mechanism | DPA |
|---|---|---|---|---|
| PostHog, Inc. (EU Cloud) | First-party product analytics — only fires if you have accepted the Analytics category in the cookie banner. Raw queries/postcodes/emails are scrubbed before forwarding. | EU (Frankfurt, AWS eu-central-1); parent USA | Adequacy (EU Cloud); parent covered by DPF UK Ext. | PostHog DPA |
| Raintank, Inc. d/b/a Grafana Labs | Telemetry (metrics, hashed-IP journal logs). EU region (GCP Belgium). | USA (parent); EU (data region) | DPF UK Ext. | Grafana DPA |
Payments & billing
| Processor | Role | Country | Mechanism | DPA |
|---|---|---|---|---|
| Stripe, Inc. | Subscription billing (ChooseOut Gold). Stripe is the payment-card controller; we hold only a Stripe customer ID + subscription state. | USA | DPF UK Ext. | Stripe DPA |
| Apple, Inc. (App Store In-App Purchase) | iOS subscription billing — original_transaction_id + StoreKit metadata | USA | UK IDTA | App Store + Developer Agreement |
| Google LLC (Play Billing) | Android subscription billing — purchase token + order metadata | USA | DPF UK Ext. | Play Developer Distribution Agreement + DPA |
Communications
| Processor | Role | Country | Mechanism | DPA |
|---|---|---|---|---|
| Resend, Inc. | Transactional email (sign-in links, billing receipts, data-export delivery) | USA | DPF UK Ext. | Resend DPA |
| Salesforce / Slack Technologies, LLC | Internal operational alerting — system-failure messages may include hashed user IDs or DSR-complaint references; never raw queries, postcodes, or emails. | USA | DPF UK Ext. | Salesforce DPA |
ML / data providers
| Processor | Role | Country | Mechanism | DPA |
|---|---|---|---|---|
| Google LLC (Gemini API) | Search-query embedding (semantic match). Raw query text is sent; never combined with user identifiers. | USA | DPF UK Ext. | Google Cloud DPA |
| Mint Data | Live restaurant-fee data provider. Receives postcode + restaurant identifiers; not linked to your user account. | United States | DPF UK Ext. | Data Processing Agreement signed. |
Advertising partners
There are none. Neither ChooseOut app contains any advertising software and neither reads an advertising identifier, so no advertising company receives any data from us. Google (AdMob, AdSense), Meta Platforms (Audience Network) and AppLovin (MAX) were listed here as advertising partners in earlier versions of this page and have been removed: the components were taken out of the iOS build and never shipped in the Android one. See §7 of the privacy policy.
The ad slots in the website layout are only ever filled if we switch on Google AdSense, which is off today. If we turn it on, or reintroduce advertising to the apps, this page and the privacy policy will be updated first and the partner will be listed here again before any data reaches it.
What this list does NOT cover
- You as data subject. This list is sub-processors who handle personal data on our behalf. You are a data subject, not a sub-processor.
- Delivery platforms (Uber Eats, Deliveroo, Just Eat). When you tap “Order” we redirect you to their site or app. From that point they are their own data controller for your transaction; their privacy policy applies. We do not transmit your personal data to them on your behalf.
- One-off contractors who do not handle personal data (e.g. designers, copy editors).
Changes
We aim to give at least 30 days’ notice on this page before adding a new sub-processor for personal-data processing. Material changes are also announced in the app or by email.
If you have questions or want to object to a specific transfer, email [email protected].