Sub-processors
Last Updated: July 31, 2026
When you use Vashana to run a website, a booking engine or a shop, we process personal data on your behalf — your visitors, your customers, your renters. For that data you are the controller and we are the processor, and the terms are set out in our Data Processing Agreement.
To provide the Service we engage the third parties below. This page is the list referred to in Section 5 of that agreement. We keep it current, and we announce changes before they take effect.
1. Sub-processors we engage
| Sub-processor | What it does for us | Data it may process | Processing location |
|---|---|---|---|
| Fly.io (Fly.io, Inc., USA) | Application hosting and the managed database our services run on | All data processed by the Service, as it passes through and rests in our applications | EU (Stockholm / Amsterdam regions) |
| Cloudflare (Cloudflare, Inc., USA) | Object storage (R2) for site files and booking evidence, edge serving of published sites, DNS and CDN | Site content, uploaded files, booking agreement snapshots and check-in/check-out photos, visitor IP addresses in transit | Global edge; R2 buckets configured to EU jurisdiction |
| Supabase (Supabase, Inc., USA) | Authentication for Vashana accounts | Account holder email address and authentication identifiers. Not your visitors' data. | EU (eu-central) |
| Resend (Resend, Inc., USA) | Transactional email — booking confirmations, pickup instructions, return reminders, contact-form delivery | Recipient name and email address, and the booking details contained in the message | USA (SCCs) |
| OpenAI (OpenAI, L.L.C., USA) | Generating and editing site content, and answering visitor questions where you enable the site assistant | The content and instructions you supply, and visitor messages to a site assistant you have enabled. Sent via the API, which is not used to train their models. | USA (SCCs) |
| Sentry (Functional Software, Inc., USA) | Error monitoring | Diagnostic data attached to an error: request path, identifiers, and any personal data incidentally present in an error context | EU (de region) |
| Grafana Labs (Grafana Labs, USA) — Grafana Cloud Loki | Application log aggregation, retained 14 days | Application logs, which may contain identifiers such as a booking id or a space id | EU |
| FastSpring (Bright Market, LLC, USA) | Subscription billing for Vashana plans, as merchant of record | Your own billing details as our customer. Not your visitors' data. | USA (SCCs) |
| OpenSRS (Tucows Inc., Canada) | Domain registration, where you register a domain through us | Registrant contact details required by the registry | Canada (adequacy decision) |
2. Payment providers are not our sub-processors
This distinction is worth stating plainly, because it is unusual and it is in your favour.
When you take bookings or payments, the money goes to your own Vipps MobilePay sales unit or your ownStripe account. Vashana never holds it, and we are not the merchant. You have your own agreement with that provider, and they process your customers' payment data for you — not for us.
What we do is act on your instruction: we call their API with the credentials you connected, and we transmit the booking details needed to take the payment (typically a name, an email address, an amount and a reference). That transmission is part of our processing under the DPA. The provider's own handling of that data is between you and them.
The practical consequence: if you disconnect a provider, we stop calling it, but any data it already holds remains subject to your agreement with that provider.
3. Changes to this list
We will give you at least 30 days' notice before a new sub-processor starts processing personal data on your behalf, by updating this page and emailing the address on your account.
If you have a reasonable objection on data-protection grounds, tell us within those 30 days and we will work with you to find a solution. If we cannot, you may terminate the affected part of the Service without penalty for the remainder of your term. Section 5 of the DPA sets this out in full.
To be notified of changes, email [email protected] and we will add you to the notification list.
4. Contact
Alvesta Systems AS (Org. nr. 936 927 548), Norway — [email protected]