Current sub-processors
| Provider | What it does | Data involved | Where |
|---|---|---|---|
| Vercel | Hosting the marketing site and the operator console, and serving them to browsers | Request logs, IP addresses, data in transit | European Union |
| Railway | Hosting the booking and operations API | All data in transit through the application, and application logs | European Union |
| Supabase | Managed Postgres database, authentication and file storage | All customer records, bookings, payments and staff accounts | European Union (Ireland) |
| Google Ireland Limited | Business email for our own correspondence, and Google sign-in where an operator chooses it | Email content and addresses we correspond with; for sign-in, the operator's name and email address | European Union (Ireland) |
| Stripe | Card payment processing on the sauna's own connected account | Payment details, amounts, payment references. Card numbers go to Stripe directly and never to us | European Union, with transfers under standard contractual clauses |
| Resend | Transactional email: booking confirmations, reminders and enquiry replies | Recipient name and email address, message content | European Union, with transfers under standard contractual clauses |
Notice of changes
We email every customer at least thirty days before a new sub-processor starts processing personal data. If you object on reasonable data protection grounds within that period, section 7 of the data processing agreement sets out what happens next, including your right to leave without penalty if we cannot resolve it.
How they are bound
Each sub-processor is engaged under written terms at least as protective as our own data processing agreement, covering confidentiality, security, breach notification, deletion and international transfers. Where a provider requires a transfer outside the EEA, that transfer relies on an adequacy decision or on standard contractual clauses.
What we deliberately do not use
- No advertising or retargeting platforms.
- No third-party website analytics that profile visitors.
- No data brokers or enrichment services.
- No AI provider receives your customers’ personal data.
Questions
Email privacy@tighsauna.com. If an auditor or an insurer needs this confirmed on headed paper, ask and we will send it the same day.