Привлекаемые обработчики

A subprocessor is a company we use to run revoo.me that handles personal data on our behalf. Article 28(2) of the GDPR requires us to tell the businesses we work for who they are, and to give notice before the list changes.

This page has its own address because it changes more often than the documents that reference it. The data processing agreement incorporates it by reference, so a change here is announced rather than requiring a new signature.

The current list

Infobip is the one provider on this list with no Chapter V question: the messages your clients receive are delivered from inside the European Economic Area.

What each of them actually sees

• Railway holds the database, and therefore everything in it. It is the provider with the broadest technical access and the one our security measures are principally aimed at.
• Vercel serves the pages. It sees the requests that reach them, and — through Web Analytics and Speed Insights — cookieless page-view and performance data.
• Stripe sees the workspace owner's billing details. It never sees client records. Card details never reach us at all.
• Infobip sees the recipient's address and the content of the message being sent to them.
• Cloudflare sees the request that submits a booking form or a sign-in, for the duration of the challenge.
• Google sees only the sign-in itself, and only for members of staff who choose to use it.
• Google Maps Platform draws the map on your public page and finds your address on it, so Google receives the visitor's IP address and browser details along with your published address. In the page editor it also receives what you type into the address field, to suggest matches. Under Google's terms for this service Google decides on that data as a controller in its own right, which is why it is listed separately from Google sign-in.
• Better Stack receives a report when something in revoo.me fails: what broke, where, and the internal ids involved. Email addresses and phone numbers are masked before it leaves us, and form contents, cookies and screen recordings are never sent. Its uptime checks see only our public pages.

None of them is permitted to process the data for its own purposes.

How this list changes

Before a provider is added or replaced we publish the change here and notify workspace owners at least 30 days in advance. A workspace owner may object within that period on reasonable data protection grounds; if the objection cannot be resolved, they may terminate the affected part of the service and be refunded any period paid for and not used.

Removing a provider needs no notice.

Every version of this page carries a number and the date it took effect, and earlier versions stay published at their own addresses, so it can always be shown which list was in force on a given day.