Sub-processors
Last updated:
These are the companies casflows uses to process the data it processes on your behalf (sub-processors, art. 28 GDPR), under the data processing agreement. List updated on 6 October 2026.
List#
| Entity | Function | Location and access | Data | International transfers |
|---|---|---|---|---|
| Supabase (Supabase Pte. Ltd.) | Database, authentication and private file storage (incident photos and, if you ask for them, photos of the finished cleaning). | Data hosted in the European Union (Frankfurt, Germany). The company (in Singapore, part of the group of Supabase, Inc., US) and some of its sub-processors may access it from outside the EEA, for example to provide support. | All the data casflows processes on your behalf: guests (dates, booking code and, if you turn them on, name and number of guests), your team members, the users of your account, incidents with their photos, photos of the finished cleaning (if you ask for them) and team payments. | Data processing agreement (DPA) with the European Commission’s Standard Contractual Clauses, incorporated into its terms. |
| Vercel (Vercel Inc.) | Application hosting and server execution. | Server functions in the European Union (Frankfurt). US company: its delivery network is global and its staff may access from outside the EEA. | The data passing through the application while it is used (in transit) and technical server logs (without the content of forms). | Data processing agreement (DPA) with the European Commission’s Standard Contractual Clauses; Vercel Inc. participates in the EU-US Data Privacy Framework (European Commission adequacy decision). |
| Cloudflare (Cloudflare, Inc.) | Domain DNS (application traffic does not go through it) and reception of the email you forward from Airbnb (Email Routing and Workers), which it processes in transit to deliver it to casflows. | Global network (email may be processed outside the EEA). US company. | The Airbnb emails you forward, in transit. Also an activity log of each email (sender, recipient, subject —which may include the guest's name— and delivery result), which its dashboard keeps for 30 days; only the administrators of casflows' Cloudflare account can view it. | Data processing agreement (DPA) with the European Commission’s Standard Contractual Clauses, incorporated into its terms; Cloudflare, Inc. participates in the EU-US Data Privacy Framework (European Commission adequacy decision). |
| Google (Google LLC / Google Ireland Ltd.) | Google Calendar, only if you or a team member connect it: casflows creates and updates the events in a calendar it creates for that purpose. | According to Google's infrastructure, also outside the EEA. | The events: property, dates and times of cleanings and bookings and, only in the calendars of the people you authorise, the guest's name and number of guests. | Google does not offer a data processing agreement for this use: it processes the Google account of whoever connects their calendar under its own terms and privacy policy; casflows complies with its API User Data Policy. Google LLC participates in the EU-US Data Privacy Framework (European Commission adequacy decision). |
| Telegram (Telegram Messenger Inc.) | Channel for the notices to your team and for the incident and restocking reports they send you, through the Telegram Bot API (see "Telegram" below). | According to Telegram's infrastructure, outside the European Union (Telegram Messenger Inc. and its affiliates, in the British Virgin Islands and Dubai). | The messages casflows sends (reminders and notices; the guest's name only to the people you authorise) and those it receives from the team (incident text, photos and voice notes, missing items and, if you ask for them, photos and confirmation of the finished cleaning). | No data processing agreement, standard clauses or any other Art. 46 GDPR safeguard: Telegram does not offer them to those who use its bot API. That is why casflows only sends through Telegram what each notice needs, and linking the bot is always the person’s own decision. Telegram has appointed the European Data Protection Office (EDPO) as its representative under Art. 27 GDPR. |
| Resend (Plus Five Five, Inc.) | Transactional emails to the account owners (today, the summary of a closed team payment period). | Sent from the European Union (Ireland); Resend account data and the log of what is sent, in the US. US company. | Owners' email and the content of the summary: team members' names, cleanings, amounts and booking codes (never the guest's name). | Data processing agreement (DPA) with the European Commission’s Standard Contractual Clauses; Plus Five Five, Inc. (Resend) participates in the EU-US Data Privacy Framework (European Commission adequacy decision). |
| Mistral AI (Mistral AI SAS) | Transcription of the voice notes your team sends to the bot to report an incident (Mistral API, Voxtral model): it receives the audio and returns the text. casflows only stores the text, in the incident; never the audio. | European Union company (Paris, France). According to Mistral, data is hosted by default in the European Union (casflows uses its European API, not the US one); some of its own sub-processors may process it temporarily outside the EU. | The voice notes of your team members (their voice and what they say) and the resulting text. Mistral may keep them for a limited time to monitor abuse of its service, except with zero data retention; casflows has turned off the use of its calls to train its models. | Data processing agreement (DPA) incorporated into its terms. EU company with data hosted by default in the EU: there is no international transfer; if any of its sub-processors processes it outside the EU, Mistral states that it is covered by Art. 46 GDPR safeguards. |
Telegram#
- What Telegram does: each person who uses Telegram has their own account and accepts Telegram's terms; Telegram transmits and stores the messages (including the bot's) as the provider of the messaging service, under its own terms and privacy policy. casflows does not control that. Telegram does not offer a data processing agreement to those who use its bot API, so casflows does not have one signed with Telegram.
- What casflows does on your instructions: casflows sends the reminders and notices and receives the incident reports (text and photos) and restocking reports through the Telegram Bot API. That sending and receiving is processing casflows carries out on your behalf, covered by the data processing agreement, even though it goes through Telegram’s infrastructure without a data processing agreement or Art. 46 GDPR safeguards (see the table). A person opening the bot does not replace your obligations as controller (for example, informing them): it only allows the bot to message them.
- How to limit it: the guest’s name only goes to people with the “See the guest’s name” box ticked, and with “Doesn’t use Telegram” that person receives nothing through this channel.
Who is not a sub-processor#
- Airbnb: it reads the "Block on Airbnb" link because you give it to Airbnb; and you give casflows the iCal link of your listing. Airbnb processes that data on its own account.
- No payment provider: casflows does not charge today and no payment provider processes any data. If we turn on charging, that provider will process your payment data with casflows as controller (never your guests' or your team's data) and we will say so beforehand in the privacy policy.
Changes to this list#
Before adding or replacing a sub-processor (or changing where it processes the data), we will give at least 30 days' notice by email to the owners of each account and with a notice in the app, and we will update this page. You can object under the data processing agreement. Questions: privacidad@casflows.com.