Subprocessors
Last updated: 6 October 2026
These service providers process personal data for Caterway. Those marked "Yes" in the last column can receive a caterer's customers' data and are subprocessors under our Data Processing Agreement. The rest serve our own business and are listed so the picture is complete. Our Privacy Policy explains the rest.
| Provider | Purpose | Location | Personal data | Your customers’ data? |
|---|---|---|---|---|
| Supabase, Inc. | Database, sign-in, file storage and server functions. | EU: Paris, France (AWS eu-west-3). | Everything stored in the service, including your customers’ data. | Yes |
| Vercel Inc. | Hosts the website and app. With analytics consent only: Vercel Analytics and Speed Insights on caterway.io and the dashboard. | Server functions in the EU (Frankfurt, fra1). Pages are delivered through Vercel’s global edge network. | Web requests, including IP address and the content of the pages and forms in transit. | Yes |
| Resend, Inc. | Sends all email from the service, including quotes and confirmations to your customers. | EU: Ireland (eu-west-1). Resend, Inc. is a US company, so this is a transfer outside the EU, covered by Resend’s data processing agreement and the EU standard contractual clauses. | Recipient names and email addresses, and the email content. | Yes |
| Stripe Payments Europe, Limited | Caterway subscription billing. Card details go straight to Stripe’s hosted pages. | EU: Ireland. Stripe may transfer the data within the Stripe group, including to the United States, under Stripe’s own data processing agreement. | The caterer’s billing details. Not your customers’ data. | No |
| Google Cloud (Gemini Enterprise Agent Platform, formerly Vertex AI) | AI features you start yourself: menu import, order import and text drafting. Also Caterway’s own sales CRM (classifying and summarising replies). | EU: Google Cloud’s EU multi-region. Google documents that this endpoint keeps ML processing within EU member states. Runs in Caterway’s own Google Cloud project under Google Cloud’s data processing terms. | The files and text you submit. Order import: your customers’ names, phone numbers, email addresses, event addresses and order notes, as written in the photo or text you upload. CRM: prospects’ emails. | Yes |
| Google (Gmail API) | Syncs Caterway’s own sales mailbox with its CRM. | Google’s global infrastructure. | Correspondence with prospects. Not your customers’ data. | No |
| Sentry (Functional Software, Inc.) | Error monitoring. Session replay is off. | EU: Germany (Sentry’s EU data region). | IP address, browser, the page address and technical details of the error. An error report can include data that was on the page. | Yes |
| Cloudflare, Inc. (Turnstile) | Bot check on sign-in, signup and the quote request form. | Global. | IP address, browser details and similar technical signals. | Yes |
| Microsoft (Clarity) | Session analytics on caterway.io and the dashboard, only with analytics consent. Never on your customers’ pages. | United States. | Clicks, scrolling and page views, IP address and device details. | No |
| Web push services (Apple, Google, Mozilla) | Deliver the push notifications a caterer turns on for their own devices. | Global. | Notification text, which can include a customer’s name. | Yes |
- Provider
- Supabase, Inc.
- Purpose
- Database, sign-in, file storage and server functions.
- Location
- EU: Paris, France (AWS eu-west-3).
- Personal data
- Everything stored in the service, including your customers’ data.
- Your customers’ data?
- Yes
- Provider
- Vercel Inc.
- Purpose
- Hosts the website and app. With analytics consent only: Vercel Analytics and Speed Insights on caterway.io and the dashboard.
- Location
- Server functions in the EU (Frankfurt, fra1). Pages are delivered through Vercel’s global edge network.
- Personal data
- Web requests, including IP address and the content of the pages and forms in transit.
- Your customers’ data?
- Yes
- Provider
- Resend, Inc.
- Purpose
- Sends all email from the service, including quotes and confirmations to your customers.
- Location
- EU: Ireland (eu-west-1). Resend, Inc. is a US company, so this is a transfer outside the EU, covered by Resend’s data processing agreement and the EU standard contractual clauses.
- Personal data
- Recipient names and email addresses, and the email content.
- Your customers’ data?
- Yes
- Provider
- Stripe Payments Europe, Limited
- Purpose
- Caterway subscription billing. Card details go straight to Stripe’s hosted pages.
- Location
- EU: Ireland. Stripe may transfer the data within the Stripe group, including to the United States, under Stripe’s own data processing agreement.
- Personal data
- The caterer’s billing details. Not your customers’ data.
- Your customers’ data?
- No
- Provider
- Google Cloud (Gemini Enterprise Agent Platform, formerly Vertex AI)
- Purpose
- AI features you start yourself: menu import, order import and text drafting. Also Caterway’s own sales CRM (classifying and summarising replies).
- Location
- EU: Google Cloud’s EU multi-region. Google documents that this endpoint keeps ML processing within EU member states. Runs in Caterway’s own Google Cloud project under Google Cloud’s data processing terms.
- Personal data
- The files and text you submit. Order import: your customers’ names, phone numbers, email addresses, event addresses and order notes, as written in the photo or text you upload. CRM: prospects’ emails.
- Your customers’ data?
- Yes
- Provider
- Google (Gmail API)
- Purpose
- Syncs Caterway’s own sales mailbox with its CRM.
- Location
- Google’s global infrastructure.
- Personal data
- Correspondence with prospects. Not your customers’ data.
- Your customers’ data?
- No
- Provider
- Sentry (Functional Software, Inc.)
- Purpose
- Error monitoring. Session replay is off.
- Location
- EU: Germany (Sentry’s EU data region).
- Personal data
- IP address, browser, the page address and technical details of the error. An error report can include data that was on the page.
- Your customers’ data?
- Yes
- Provider
- Cloudflare, Inc. (Turnstile)
- Purpose
- Bot check on sign-in, signup and the quote request form.
- Location
- Global.
- Personal data
- IP address, browser details and similar technical signals.
- Your customers’ data?
- Yes
- Provider
- Microsoft (Clarity)
- Purpose
- Session analytics on caterway.io and the dashboard, only with analytics consent. Never on your customers’ pages.
- Location
- United States.
- Personal data
- Clicks, scrolling and page views, IP address and device details.
- Your customers’ data?
- No
- Provider
- Web push services (Apple, Google, Mozilla)
- Purpose
- Deliver the push notifications a caterer turns on for their own devices.
- Location
- Global.
- Personal data
- Notification text, which can include a customer’s name.
- Your customers’ data?
- Yes
Change log
- 2026-10-05: Google: AI processing moved to the EU region of Google Cloud (Gemini Enterprise Agent Platform, formerly Vertex AI), under Google Cloud’s data processing terms. Before this, AI features used the Gemini API, which had no EU region guarantee.
- 2026-10: Initial publication of this list.
Get notified of changes
We email every account owner at least 30 days before we add or replace a provider that handles customers' data. Anyone else can ask for the same notice: email support@caterway.io with the subject "Subprocessor updates".