Tideframe Bookings

Sub-processors

Sub-processors and data regions

This page lists the service providers that handle data for Tideframe Bookings, where each one processes it, and the safeguard used for transfers out of the EEA, the UK or Australia. It is a draft until the lawyer's review of our privacy and data processing documents is complete.

Where data is stored

Operator and guest data is stored in one region today: Sydney. We say where the database is hosted and do not promise more than that about residency. Some providers below process data in other countries as part of their own service, and each entry says where.

If we open a second region, for example in the EU, we will add it to this page before any operator's data is moved there.

Providers we use

These providers handle operator or guest data for Tideframe Bookings. Each entry is the same as the entry for that provider on the Tideframe Digital register at tideframedigital.com/sub-processors/.

  • Supabase (Supabase Pte. Ltd.)

    What it does
    Database, sign-in, file storage for enquiry attachments, client portal records, our error records.
    Information it handles
    Enquiries and attachments, portal accounts, client organisation records, care requests, newsletter records, billing identifiers, sign-in events.
    Where
    Project region ap-southeast-2 (Sydney). Supabase's own sub-processors may process elsewhere, including the United States and Singapore.
    Transfer safeguard
    Supabase DPA: EU SCCs Modules 2 and 3 (Irish law), UK addendum B1.0, Swiss addendum.
    Terms
    supabase.com/legal/dpa; sub-processors: supabase.com/legal/customer-resources/subprocessor-list.

  • Vercel Inc.

    What it does
    Hosts our website, client portal and server functions; website analytics (cookieless).
    Information it handles
    Request data (IP address, browser, pages requested); everything sent through our forms and portal in transit; analytics counts.
    Where
    Server functions: Sydney (syd1). Edge network and analytics: global, including the United States.
    Transfer safeguard
    Vercel DPA with 2021 EU SCCs and UK addendum; Vercel states DPF certification.
    Terms
    vercel.com/legal/dpa; sub-processors: security.vercel.com.

  • Amazon Web Services, Inc. (Amazon SES and SNS)

    What it does
    Sends sign-in codes, enquiry confirmations and notifications, newsletter emails; bounce and complaint notices.
    Information it handles
    Email addresses, names, email content (including a copy of the brief in the sender's confirmation), delivery events.
    Where
    ap-southeast-2 (Sydney).
    Transfer safeguard
    AWS GDPR DPA in the AWS Service Terms with EU SCCs and UK addendum; AWS states DPF participation.
    Terms
    aws.amazon.com/compliance/gdpr-center; sub-processors: aws.amazon.com/compliance/sub-processors.

  • Cloudflare, Inc. (Turnstile)

    What it does
    Bot check on our enquiry, newsletter and website check forms.
    Information it handles
    Browser and device signals: IP address, TLS fingerprint, user agent, site key and origin.
    Where
    Global network, usually the data centre nearest the visitor. Region: to be confirmed.
    Transfer safeguard
    Cloudflare customer DPA v6.4 (effective 3 Apr 2026): EU SCCs, UK addendum B1.0, DPF. Cloudflare is an independent controller when it uses signals to improve bot detection.
    Terms
    cloudflare.com/cloudflare-customer-dpa; Turnstile privacy addendum: cloudflare.com/turnstile-privacy-policy; sub-processors: cloudflare.com/gdpr/subprocessors.

  • Anthropic (Claude)

    What it does
    AI assistance: drafting and checking marketing research and messages, and project work as described in our privacy policy.
    Information it handles
    Published business contact details of prospects; project material where used for client work.
    Where
    to be confirmed.
    Transfer safeguard
    Under review: we are confirming which Anthropic terms and data processing addendum apply to our use.
    Terms
    anthropic.com/legal/data-processing-addendum; sub-processors: anthropic.com/subprocessors.

  • Google LLC (Google Workspace)

    What it does
    Business email, calendar and video calls. For Tideframe Bookings, also ad conversions: when an operator has opted in and a guest has agreed to ad measurement, we tell Google Ads, in the operator's own account, that a booking came from the ad the guest clicked.
    Information it handles
    Emails and attachments you send us and our replies, calendar invitations, call details. For ad conversions: the ad click identifier, the time and value of the booking, a reference number, and the guest's email address as a one-way hash, only if the operator has turned that on. Never the guest's name.
    Where
    to be confirmed. Google processes data in many countries, including the United States.
    Transfer safeguard
    Google Cloud Data Processing Addendum (last modified 8 Jun 2026) with EU SCCs; Google LLC states DPF and UK Extension certification.
    Terms
    cloud.google.com/terms/data-processing-addendum; sub-processors: workspace.google.com/intl/en/terms/subprocessors.html.

  • Stripe

    What it does
    Care plan and invoice payments, subscriptions, tax ID collection.
    Information it handles
    Billing contact name and email, organisation name, address, tax ID, payment method details (collected by Stripe directly), payment history.
    Where
    to be confirmed. Stripe's DPA and privacy policy describe processing in the United States and other countries.
    Transfer safeguard
    Stripe DPA: EU SCCs (Modules 1 to 3), UK addendum, DPF; Stripe, LLC states DPF and UK Extension compliance. Stripe is an independent controller for fraud prevention and its legal obligations.
    Terms
    stripe.com/legal/dpa; service providers: stripe.com/au/legal/service-providers.

Providers not yet in use

Twilio and 360dialog are planned for messaging in a later release. Neither handles any data yet. We will add each one here, with notice, before it does.

How we tell you about changes

When we plan to add or replace a provider that handles operator or guest data, we add it to this page marked "Proposed", with the date it is due to start. Operators get at least thirty days' notice and a right to object on reasonable data protection grounds. The data processing terms you accept when you sign up set out what happens if we cannot resolve an objection.