A subprocessor is a company we use to deliver WaitQ that may process personal data on your behalf. This page lists every subprocessor, what it does and where it runs. Not every provider handles data for every customer. Messaging providers, for example, only process data when you turn on that channel.
Infrastructure
| Subprocessor | What it does | Data it handles | Where |
| Supabase | Database, authentication and file storage | All data stored in WaitQ | United States (US East, Ohio) |
| Vercel | Application hosting, delivery and monitoring | Requests to the service and technical logs | United States (US East, Cleveland, Ohio) |
Messaging
| Subprocessor | What it does | Data it handles | Where |
| Resend | Email delivery | Email address, message content and delivery status | United States (US East, North Virginia) |
| GatewayAPI | SMS delivery | Phone number, message content and delivery status | European Union |
| BulkGate | SMS delivery | Phone number, message content and delivery status | European Union |
| Twilio | SMS, WhatsApp and verification messages. WhatsApp messages are delivered through Meta’s WhatsApp Business Platform | Phone number, message content and delivery status | United States |
Push notifications
| Subprocessor | What it does | Data it handles | Where |
| Apple Push Notification service | Push notifications and Live Activities for the WaitQ App Clip | Device token, notification text and queue status | United States |
| Browser push services (Google, Apple, Mozilla, Microsoft) | Web push notifications, through the push service of the browser each guest uses | Push subscription address and an encrypted notification the service cannot read | United States and other provider regions |
Dashboard
| Subprocessor | What it does | Data it handles | Where |
| Gravatar (Automattic) | Shows a customer’s Gravatar profile picture in the WaitQ dashboard, when they have one | A SHA-256 hash of the customer’s email address | United States |
Analytics
| Subprocessor | What it does | Data it handles | Where |
| PostHog | Product analytics for the WaitQ dashboard | How your team uses WaitQ | European Union |
| Google Analytics | Website and product analytics, loaded only after cookie consent | Pages visited and browser details | United States |
Independent controllers
These companies process data for their own purposes under their own privacy policies. They are not WaitQ subprocessors.
| Company | Role |
| Polar | Merchant of Record for WaitQ subscriptions. Handles checkout, payment, invoices and tax. |
Transfers outside the EEA
Where a subprocessor processes personal data outside the European Economic Area, the transfer is covered by the European Commission’s Standard Contractual Clauses.
Changes to this list
We’ll give customers at least 30 days’ notice before we add or replace a subprocessor, by email to the account owner and by updating this page. You can object to a change on reasonable data protection grounds during that period, as set out in our Data Processing Agreement.