Subprocessors

List

• Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Purpose: hosting of the website and app, server functions, scheduled jobs and file storage (photos, receipts, attachments). Location: server functions in the Frankfurt region (Germany), static content delivered through a global network. Safeguard: EU–US Data Privacy Framework (Vercel is certified) and standard contractual clauses in Vercel's data processing agreement.
• Neon (Databricks group, USA). Purpose: PostgreSQL database holding all app data. Location: European Union, Amazon Web Services infrastructure in the eu-central-1 region (Frankfurt, Germany). Safeguard: the provider's data processing agreement with standard contractual clauses for any access from the USA.
• Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA. Purpose: sending email (password reset, invitations, booking confirmations, venue news, backups, payment notices). Safeguard: EU–US Data Privacy Framework and standard contractual clauses.
• Apple (Apple Push Notification service), USA. Purpose: delivering notifications to iPhones and updating loyalty cards in Apple Wallet. Only the device token and notification text are transferred. Safeguard: EU–US Data Privacy Framework or standard contractual clauses under Apple's terms.
• Google (Firebase Cloud Messaging and Google Wallet), USA and Ireland. Purpose: delivering notifications to Android and the loyalty card in Google Wallet if a guest adds it (card code, venue name, stamp status). Safeguard: EU–US Data Privacy Framework or standard contractual clauses under Google's terms.
• Anthropic, PBC, USA. Purpose: an AI assistant the operator uses for platform administration and support. It receives only the data needed for a specific request (business name, names, emails and roles of its users, subscription status). Safeguard: standard contractual clauses in Anthropic's data processing terms.

Payments: Stripe

Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Processes subscription payments and issues invoices to businesses. For payment data (card, fraud prevention, payment services regulation) Stripe is an independent controller under its own policy; for customer billing data it acts as our processor. It concerns businesses only, not staff or guests. Transfers to the USA within the Stripe group rely on the EU–US Data Privacy Framework and standard contractual clauses.

Integrations enabled by the business

These providers are not our subprocessors. The business has its own contract with them and Managero sends them data only on its instruction when it enables the integration:

• Storyous point of sale (sales, receipt items and their link to a loyalty card),
• Noisium planning app (projects and tasks the business sends to it).

Browser notifications (web push) are delivered by the service chosen by the user's browser (for example Google for Chrome, Mozilla for Firefox, Apple for Safari). Only the encrypted notification content and subscription address are transferred.

Notice of changes

We announce an addition or replacement of a subprocessor to business owners by email and on this page at least 30 days in advance. A business may object within 30 days at podpora@managero.app; the procedure is in section 10 of the data processing agreement.

Change history

• 21 October 2026: first publication of the list.