Subprocessors
heycupo uses a limited set of third-party providers to run the booking platform. This page lists providers with access to customer or operator personal data.
This list is part of the Data Processing Agreement. Operators receive at least 30 days' advance notice before heycupo adds or replaces a subprocessor with access to customer personal data, unless urgency or legal requirement makes shorter notice necessary.
Current subprocessors
| Subprocessor | Purpose | Location | Data categories | Safeguard |
|---|---|---|---|---|
| Supabase | Managed Postgres database and authentication | United States, AWS us-east-1 |
Operator accounts, memberships, booking data, authentication records | Supabase DPA and SCCs where applicable |
| Cloudflare | Workers API, CDN, DNS, R2 photo storage, edge cache and Cloudflare Email Service | Global edge network | HTTP request data, hosted photos, email recipient and content where email is sent through Cloudflare | Cloudflare DPA and SCCs where applicable |
| Stripe | Card processing, Connect onboarding, KYC, connected accounts, disputes and payouts | Global | Card data processed by Stripe, payment metadata, connected account details, payout and dispute data | Stripe DPA and SCCs where applicable |
| Apple | iOS app-store subscriptions for operator plans | Global | Operator Apple purchase identifiers and subscription status where the operator buys through iOS | Apple terms and applicable platform privacy commitments |
| Android app-store subscriptions for operator plans | Global | Operator Google Play purchase token and subscription status where the operator buys through Android | Google terms and applicable platform privacy commitments | |
| Expo | Mobile push notification relay | United States | Push token and operational notification payload | Expo terms and SCCs where applicable |
| Sentry | Error and performance monitoring where enabled | United States or EU depending on account configuration | Error stack traces and request metadata, with PII minimised or scrubbed where possible | Sentry DPA and SCCs where applicable |
What heycupo does not use
- Advertising networks.
- Data brokers.
- Cross-site tracking pixels.
- Profiling analytics providers.
- Session recording tools.
- AI training partners for customer or operator data.
Change notifications
To receive subprocessor change notices, email hello@heycupo.com with the subject "subprocessor notifications".
You can unsubscribe by replying "unsubscribe".
Objections
If you object to a new subprocessor on reasonable data protection grounds, email hello@heycupo.com with the subject "subprocessor objection" and the name of the subprocessor. You may terminate the Operator Terms before the new subprocessor is engaged.
heycupo. Lisbon, Portugal. Last updated: version v2, effective 2026-04-27. See also the Privacy Policy and DPA.