Draft — pending legal review
This document is a draft that has not yet been reviewed by a lawyer. It is not legal advice and is not yet in force. Text in highlighted [square brackets] is still to be completed.
Sub-processors
- Version
- 2026-10-01
- Effective date
- (provisional)
- Last updated
About this list
To run spareachair we use a small number of service providers (“sub-processors”) that process personal data on our behalf, under a data processing agreement and only on our instructions. This page lists them. For how we use personal data overall, see the Privacy Policy.
Our own media server (for live voice and video) runs on our DigitalOcean infrastructure; audio and video are never recorded or stored.
The app and service
| Provider | Purpose | Personal data | Location | Safeguards |
|---|---|---|---|---|
| DigitalOcean, LLC | Cloud hosting: servers, managed database and cache, file storage (e.g. data exports), backups, and hosting of this website | All app data we hold (account, profile, messages, reports, logs) | EU data centre ([DigitalOcean EU region (to be confirmed)]); company established in the USA | Data processing agreement (Art. 28 GDPR); EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework for any transfer outside the EU/EEA |
| Resend | Sending transactional email (sign-up verification, reminders, report acknowledgements, statements of reasons) | Email address, name you gave us, email content | Company established in the USA; sending region to be confirmed | Data processing agreement (Art. 28 GDPR); EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework for any transfer outside the EU/EEA |
| Didit | Identity and age verification (ID document check and selfie / liveness match) at sign-up | ID document images and data, selfie and biometric template (processed by Didit only); we receive only the result | EU (to be confirmed against the DPA) | Data processing agreement (Art. 28 GDPR); explicit consent (Art. 9 GDPR) |
| Sentry (Functional Software, Inc.) | Error and crash monitoring for the app and backend | Technical data (device and app version, error traces, pseudonymous user ID) | EU data region (to be confirmed); company established in the USA | Data processing agreement (Art. 28 GDPR); EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework for any transfer outside the EU/EEA |
| Expo (650 Industries, Inc.) | Delivering push notifications (via Apple and Google push services) and over-the-air app updates | Push token, notification content, device and app version | USA | Data processing agreement (Art. 28 GDPR); EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework for any transfer outside the EU/EEA |
| [Moderation API provider (OpenAI or Anthropic — to be decided)] | Automated text moderation: classifying chat messages for harmful content | Text of messages sent at tables and in direct messages | To be confirmed | Data processing agreement (Art. 28 GDPR); EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework for any transfer outside the EU/EEA |
The website
These providers are only used on spareachair.com, and only if you accept the relevant cookies. See the Cookie Policy.
| Provider | Purpose | Personal data | Location | Safeguards |
|---|---|---|---|---|
| Google (Google Analytics 4, Google Ads) | Website analytics and ad measurement — only if you accept analytics/marketing cookies | Cookie identifiers, pages visited, device and browser data, approximate location | Google Ireland Ltd (EU) / Google LLC (USA) | Only after consent (Consent Mode v2); Data processing agreement (Art. 28 GDPR); EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework for any transfer outside the EU/EEA |
| Meta (Meta Pixel) | Ad measurement for our campaigns — only if you accept marketing cookies | Cookie identifiers, pages visited, device and browser data | Meta Platforms Ireland Ltd (EU) / Meta Platforms, Inc. (USA) | Only after consent; Data processing agreement (Art. 28 GDPR); EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework for any transfer outside the EU/EEA |
Changes
When we add or replace a sub-processor, we update this page, its version number and its effective date. If a change materially affects how your data is handled, we will also update the Privacy Policy and tell you.
Contact
Questions about our sub-processors: privacy@spareachair.com.