Subprocessors
Last updated: 5 August 2026
Overview
Under Article 28 of the GDPR, we use the following subprocessors to deliver the SuperHoreca service. Each is bound by a Data Processing Agreement with Sidestream OÜ and is certified, located in the EU, or contractually equivalent to GDPR standards (EU-US Data Privacy Framework where applicable).
The legal terms of our processor relationship with Customers are set out in our Data Processing Agreement.
Current subprocessors
| Subprocessor | Purpose | Location | Safeguards |
|---|---|---|---|
| Vercel Inc. | Application hosting and edge delivery | USA (EU regions used where available) | EU-US Data Privacy Framework certified, SCCs |
| Neon Inc. | Managed Postgres database (Customer data at rest) | EU (Frankfurt region) | EU-located, SOC 2 Type II |
| Resend Inc. | Transactional and marketing email delivery (incl. newsletter, onboarding, supplier orders) | USA | EU-US Data Privacy Framework, SCCs |
| Stripe Payments Europe Ltd | Payment processing for paid subscriptions | Ireland (EU) | EU-located, PCI-DSS Level 1 |
| Google LLC (Analytics, Ads, Tag Manager, OAuth) | Website analytics, advertising measurement, and sign-in with Google | USA | EU-US Data Privacy Framework, SCCs. Analytics and advertising load only after the visitor gives that specific consent, and Consent Mode is set to denied until then; OAuth runs only when a user chooses to sign in with Google. |
| PostHog Inc. | Product analytics — which features get used, where onboarding stalls | EU (PostHog EU Cloud, Frankfurt) | EU-located, so no third-country transfer. Loaded only with analytics consent. |
| Upstash Inc. | Distributed rate limiting for login, registration and public booking endpoints | EU (Frankfurt region) | EU-located. Stores only a hashed request counter keyed on IP, expiring within minutes. |
| GitHub Inc. | Source code hosting (no Customer data) | USA | EU-US Data Privacy Framework |
Notification of changes
We notify Customers of any new subprocessor at least 30 days in advance via the Customer’s primary contact email. Customers may object to a new subprocessor — on reasonable, documented grounds — by emailing info@superhoreca.app within the notice period. Where we cannot accommodate the objection, the Customer may terminate the affected portion of the Service on the terms set out in our Data Processing Agreement.
Contact
Sidestream OÜ
Ahtri tn 12, 15551 Tallinn, Estonia
Privacy contact: info@superhoreca.app
Registry code: 17374822