Este documento se proporciona en inglés. La versión en inglés es la única versión que rige; todavía no hay una traducción certificada al español. This document is provided in English. The English version is the only authoritative version; a certified Spanish translation is not yet available.
PeasyBooking — Subprocessor List
Effective date: 2026-07-21
Version: 1.1
This Subprocessor List is published by PeasyBooking Technologies Inc. (operating as "PeasyBooking", "we", "us", or "our"), a corporation incorporated under the Canada Business Corporations Act (Corporation No. 1804322-1), with its registered office at 150 Evergreen Mount SW, Calgary, Alberta T2Y 0L8. Questions about this list may be directed to info@peasybooking.com.
---
1. What this list is
A subprocessor is a third-party service provider that PeasyBooking engages to process personal data on our behalf in order to deliver the PeasyBooking platform. This page identifies the subprocessors we currently use, the purpose for which each one is engaged, the categories of data it may process, and the region or country in which that processing primarily takes place.
This list is the authoritative source of PeasyBooking's current subprocessors. It is referenced by, and should be read together with, the Privacy Policy and the Data Processing Agreement (DPA). Where those documents refer to "our subprocessors" or "the current subprocessor list," they mean this page. For details on where data is stored, how long it is retained, and what remains after account closure, see the Data Retention Schedule.
Each subprocessor identified below is engaged under a written agreement that requires it to (a) protect personal data to a standard comparable to PeasyBooking's own obligations under the Privacy Policy and DPA, and (b) process that data only as needed to provide the contracted service, and not for advertising, profiling, independent analytics, AI training, or its own product development. This reflects PeasyBooking's accountability for transfers of personal data to third parties for processing, including cross-border transfers, under PIPEDA and Alberta's Personal Information Protection Act (PIPA).
---
2. Current subprocessors
These subprocessors process personal data of PeasyBooking's Customers and their staff, business clients, and PeasyBooking marketplace guests (consumers who discover, book, review, pay, or communicate through the PeasyBooking marketplace). Where a category below references "client/guest" data, it includes marketplace-guest profiles, searches, bookings, reviews, and payment/contact and communication details, in addition to Customer and business data.
| Subprocessor | Purpose | Categories of data | Region / country |
|---|---|---|---|
| Google LLC — Google Cloud Platform | Application hosting, PostgreSQL database, and file storage for the platform | Core customer (account) data, business client data, and marketplace-guest data — including profiles, searches, bookings, calendars, services, reviews, and messages.¹ | Canada — Montréal (northamerica-northeast1) for live data; United States (us multi-region) for database backups and point-in-time-recovery copies |
| Google LLC — Google Identity Platform / Firebase Authentication | Account sign-in and authentication (Customers, staff, and marketplace guests) | Account identifiers (e.g., email address, user ID) and authentication metadata (e.g., sign-in events, tokens, device/session information) | United States / global |
| Stripe, Inc. | (a) PeasyBooking subscription billing; (b) where a business enables the optional online-payments feature, processing of client→business and guest→business payments via direct charges on the business's own Stripe connected account (the business is the merchant of record) | Payment and contact data (e.g., name, email, billing details, transaction records), for Customers and for marketplace guests. Full card numbers are handled by Stripe and are not stored by PeasyBooking.² | United States / global |
| Resend, Inc. | Transactional email delivery (e.g., confirmations, reminders, notifications) to Customers, staff, and marketplace guests | Email addresses and email message content. May include appointment- and business-related details where the email concerns a booking. | United States |
| Twilio Inc. | Text-message (SMS) delivery for the optional SMS add-on — appointment confirmations and reminders, and two-way "reply to confirm/cancel," to clients/guests where the add-on is enabled and the recipient has opted in | Mobile telephone numbers, message content, and SMS metadata (delivery status, timestamps). May include appointment- and business-identifying details where the message concerns a booking. | United States / global |
| [Map-tile service — name before Marketplace launch] (effective at Marketplace launch; not active while the Marketplace is dark) | Display of interactive maps on Marketplace pages. The visitor's browser requests map tiles directly from this service; PeasyBooking does not transmit personal data to it | IP address and standard technical request data of Marketplace visitors, received by the service directly from the visitor's browser under its own privacy policy | [Confirm region] |
¹ Encryption at rest. Data listed above is encrypted at rest in Google Cloud, where Google as our hosting subprocessor handles it on our behalf only to operate the service.
² Stripe's role differs by transaction. For PeasyBooking's own subscription billing, Stripe processes personal data on PeasyBooking's behalf (PeasyBooking is the merchant/controller for that billing). For client→business and guest→business service payments, online payment is an optional feature a business enables by connecting its own Stripe account; payments are then processed via Stripe direct charges on the business's connected account: the business is the merchant of record, funds settle directly to the business, PeasyBooking does not receive, hold, control, settle, or take title to those funds, and Stripe processes that payment data on the business's behalf (with the business as controller/merchant), not PeasyBooking's. This list does not govern that relationship; the Privacy Policy and DPA describe the payment-roles split in more detail.
SMS provider: Twilio. PeasyBooking's optional SMS add-on is delivered through Twilio Inc. Each participating business is assigned its own dedicated sending number, and Twilio processes mobile numbers and message content solely to deliver SMS on PeasyBooking's behalf. Adding Twilio is the addition of a new subprocessor: affected Customers receive the 30-day advance-notice-and-objection process described in section 4 before Twilio begins processing their Customer Data (in practice, before the SMS add-on is enabled for their account). SMS is opt-in for recipients and carries STOP/HELP handling; see the Privacy Policy for the consent details.
---
3. Data residency note
Core customer, business client, and marketplace-guest data is hosted at rest in Canada (Google Cloud, Montréal region). The automated database backups and point-in-time-recovery copies of that data are stored in the United States (Google Cloud us multi-region); they are used for disaster recovery only and age out on the schedule in the Data Retention Schedule. In addition, certain limited data is processed by subprocessors located in the United States or globally in order to provide specific features, namely authentication (Google Identity Platform / Firebase Authentication), payments (Stripe), email delivery (Resend), and SMS delivery (Twilio).
This means some transactional communications (e.g., appointment confirmations or reminders that include business or appointment identifiers) may transit US-based subprocessors to be delivered, even though the underlying live client records remain stored in Canada. Because of these flows and the United States backup location, PeasyBooking does not represent that all data remains in Canada at all times. The Privacy Policy and DPA describe these cross-border flows in more detail, and each US/global subprocessor is engaged under a written agreement requiring comparable protection as described in section 1.
---
4. Changes to this list and notice
PeasyBooking may add, replace, or remove subprocessors from time to time as the platform evolves. In accordance with the Data Processing Agreement, PeasyBooking will give affected Customers at least 30 days' notice before a new subprocessor begins processing Customer Data (or before a material change to an existing subprocessor's engagement), so that the Customer has an opportunity to review and, where the DPA so provides, object to the change. This same 30-day advance-notice-and-objection process applies to the addition of Twilio as the SMS provider referenced in section 2, before it begins processing Customer Data.
The most current version of this list is always the one published at this page. Material changes are reflected by updating the "Last updated" date below and, where required by the DPA, by separate notice to affected Customers.
---
5. Cross-references
- Privacy Policy — how PeasyBooking handles personal data across its different roles (account holders and staff, marketplace guests, and business client records).
- Data Processing Agreement (DPA) — PeasyBooking's obligations when processing Customer Data on a Customer's behalf, including subprocessor terms and notice rights.
- Data Retention Schedule — how long data is kept, what is deleted on account closure, and what remains in backups and third-party systems.
---
6. Version history
This list is maintained under version control. Material changes are recorded here, and each superseded version is archived.
| Version | Date | Change |
|---|---|---|
| 1.1 | 2026-07-21 | Clinical/health-data references removed following the medical de-scope; PeasyBooking no longer offers clinical features. Processing descriptions now refer to client and booking data. |
| 1.0 | 2026-07-02 | Finalized for publication following legal review. Removed draft/non-binding language and assigned a version number. Reflects the current subprocessor set (Google Cloud, Google Identity Platform/Firebase, Stripe, Resend, Twilio) with Stripe's optional provider-connected direct-charge model. |
| (pre-1.0) | 2026-06-27 | Pre-publication working draft. Added Twilio (SMS) as a subprocessor; revised the Stripe payment-roles description to the direct-charge model. |
Map-tile provider (before Marketplace launch): the map-tile service row above is a placeholder. Before the Marketplace is activated, name the map-tile provider and its region, publish it as a new version of this list, and give affected Customers the 30-day notice in section 4.
Each superseded version of this list is archived and available on request.
---
Last updated: 2026-07-21
This Subprocessor List is governed by the laws of the Province of Alberta and the federal laws of Canada applicable therein. For questions, contact info@peasybooking.com.