Last updated 9 November 2026
Sub-processors
Annex 3 of our data processing terms. We give at least 30 days' notice of a new or replacement sub-processor here and by email to account owners.
| Sub-processor | What for | Where data is processed | Transfer safeguard |
|---|---|---|---|
| Vercel Inc. (USA) | Hosting and server functions; file storage (photos, documents); AI Gateway for AI features | Functions: London. File storage: menu and marketing photos in Washington DC, USA; food safety photos and documents in a private store in London (existing safety documents are being moved there) | ICO International Data Transfer Addendum with EU Standard Contractual Clauses (Vercel DPA, Pro plan) |
| Databricks, Inc. (Neon) (USA) | Database | London | UK Extension to the EU–US Data Privacy Framework; Databricks DPA with Standard Contractual Clauses |
| Clerk, Inc. (USA) | Sign-in for owners and staff | USA | UK Extension to the EU–US Data Privacy Framework; UK Addendum (Clerk DPA) |
| Resend (USA) | Sending emails | USA | UK Extension to the EU–US Data Privacy Framework; Standard Contractual Clauses with the UK Addendum (Resend DPA) |
| Ably Realtime Ltd (UK) | Live update signals between screens. Messages carry no personal data; connection details only | UK, with a worldwide edge network | ICO UK Addendum for any transfer outside the UK (Ably DPA) |
| The SMS Works Ltd (UK) | Sending text messages | UK | Not needed (UK). Its optional "AI Optimiser", which would send message content to OpenAI in the USA, is not used |
| WhatsApp LLC (Meta) (USA) | Sending WhatsApp messages, where you use them | USA and Meta's data centres | WhatsApp Business UK Data Transfer Addendum (WhatsApp Business Data Processing Terms) |
| OpenAI OpCo, LLC (USA) | AI features you choose to use: reading uploaded menus (menu import), reading supplier invoices, and the Insights summaries of your sales | USA | Standard Contractual Clauses with the UK Addendum (OpenAI DPA). OpenAI is not certified under the Data Privacy Framework |
Not sub-processors:
- Stripe processes payments on your own Stripe account, under your agreement with Stripe
- AI assistants you connect yourself (such as Claude or ChatGPT) act under your own account with that provider
- Microsoft Clarity and Google Ads run only on Café QR's public marketing website, with Café QR as controller, and never on café, staff or guest pages
- Help-centre answers: a question typed into the help centre's answer box is a support question to Café QR, with Café QR as controller. It is sent, with the matching help articles, to Google (Gemini), Groq or Cloudflare to write a short answer, as our privacy notice explains. Don't include personal details in help questions