Sub-processors
Every company that helps us run turnda and can see the personal data businesses put into it — what each one handles, and where.
Last updated 2 October 2026
This page is published in English. If it is translated into any other language, the English version governs.
A sub-processor is a company that helps us run turnda and, in doing so, may handle personal data that businesses put into turnda — about their visitors or their own team. This is the complete list. We update this page before adding anyone new, and email every business at least 14 days ahead, as our Data Processing Agreement promises.
The list
| Company | What it does for turnda | What personal data it can see | Where |
|---|---|---|---|
| Supabase | Our database, sign-in, file storage and backups | Everything a business stores in turnda: its account, its team, its locations, and its visitors' details. Also sign-in records, uploaded images and our nightly backups | Frankfurt, Germany (EU) |
| Fly.io | Runs the turnda application | Every request passes through it while being handled; it stores no business data | Application in Frankfurt, Germany (EU). Connections are accepted at Fly.io's location nearest the person and passed on to Frankfurt |
| Upstash | Our background job queue and our abuse counters | Network addresses (IP addresses), held for at most 15 minutes to block abuse. The job queue carries no personal data | Frankfurt, Germany (EU) |
| Stripe | Payments and subscriptions | The business's card and billing details, entered directly into Stripe. turnda never receives a card number | Stripe's own locations, including the United States |
| Meta (WhatsApp Business Platform) | Sends and receives WhatsApp messages on the turnda number | A visitor's WhatsApp number, profile name and the messages in both directions | Meta's own locations, including the United States |
| Resend | Sends email: messages to visitors, and email to business owners and their teams | The recipient's email address and the message | Sends from Ireland (EU); Resend is a United States company |
| Cloudflare | Our domain names, and the routing of email sent to turnda.com addresses | Which turnda address was looked up; and the content of any email sent to us, which it routes to our mailbox. It does not carry visits to the turnda app | Cloudflare's global network, including the United States |
| "Continue with Google" sign-in, and our support mailbox (Gmail) | For sign-in: the email address, name and profile picture of a person who chooses Google. For the mailbox: anything people email to us | Google's own locations, including the United States | |
| Sentry | Tells us when the software breaks | Technical details of the fault only. Personal-data collection is switched off and the contents of the program's memory are never sent | Germany (EU) |
Not in use, but built in
The software can also send WhatsApp messages through Twilio, Gupshup or 360dialog. None of them is in use and turnda has no account with any of them. If we ever switched to one, we would add it to the list above and give businesses at least 14 days' notice first, like any other new sub-processor.
Services we use that do not receive business or visitor data
- Google Analytics counts visits to turnda.com, without cookies. It receives the browser request of someone reading our website, never data from the turnda app. See our Privacy Policy, section 3.3.
- UptimeRobot checks from outside that our public pages are up. It sees only those public pages.
- GitHub holds turnda's source code. No business or visitor data is stored there.
Two things that are not sub-processors, but worth knowing
- A logo given as a link. If a business gives us its logo as a link to a picture on another website instead of uploading it, visitors' browsers load the picture from that website, which can see their network address. We do not choose that website and have no agreement with it. An uploaded logo avoids this.
- A video on a lobby screen. If a business shows a YouTube or Vimeo video on its lobby screen, the screen loads it from Google or Vimeo. That is the business's own device, so the address seen is the business's.
Where your data is
Stored in Frankfurt, in the European Union — the database, sign-in, files and backups. Connections are accepted at the location nearest the person and passed on, and the companies above that are based elsewhere may handle data outside the EU under their own data-protection terms. So it is accurate to say your data is stored in the EU; it would not be accurate to say it never leaves it.
If anything on this page looks wrong, tell us at legal@turnda.com and we will check it against the running system and correct it.
Also see our Privacy Policy, Data Processing Agreement and Terms of Service.