Sub-Processors
Last updated October 1, 2026
TablePort LTD uses the following third-party sub-processors to deliver our
Services. This page is maintained in accordance with our Data Processing
Agreement (Schedule 1, Section DPA.4).
We will update this page and notify affected customers via email at least 30
days before engaging a new sub-processor. Customers may object per the terms of
their Services Agreement.
Infrastructure & Hosting
| Provider | Purpose | Data Processed | HQ Location |
|---|
| Amazon Web Services (AWS) | Cloud hosting, database, file storage, Lambda compute | Service data; primary database, snapshots and backup copies encrypted at rest; other resources require resource-specific verification | US (API/database in us-east-1); database backup copies configured to the UK (eu-west-2) |
Content Delivery, DNS & Bot Protection
| Provider | Purpose | Data Processed | HQ Location |
|---|
| Cloudflare | CDN, DNS, WAF, bot protection (Turnstile) and edge hosting for websites | IP addresses, request metadata, bot-challenge tokens (transient), web content | US |
Payment Processing
| Provider | Purpose | Data Processed | HQ Location |
|---|
| Stripe | Online and card-present payment processing (Stripe Connect) | Payment tokens, transaction amounts, merchant account data | US |
| PayPal / Zettle | In-person card payment processing | Payment tokens, transaction amounts | US / Sweden |
Analytics (Consent-Based Only)
| Provider | Purpose | Data Processed | HQ Location |
|---|
| Microsoft Clarity | Session replay analytics | Page interactions and masked session recordings, without persistent tracking identifiers in Console 1.41.202 (analytics consent required; not guaranteed anonymous) | US |
Error Monitoring
| Provider | Purpose | Data Processed | HQ Location |
|---|
| Sentry | Application error monitoring | Minimised error diagnostics and stack traces; known identifiers and credentials filtered in the reviewed Console release. Free text may still contain personal data. | US |
Communications
| Provider | Purpose | Data Processed | HQ Location |
|---|
| Twilio | SMS delivery (OTP codes, booking notifications) | Phone numbers, message content | US |
| Slack | Internal operational notifications | Operational alerts; personal data may be included depending on the alert | US |
Maps & Location
| Provider | Purpose | Data Processed | HQ Location |
|---|
| Google Maps Platform | Map display, address geocoding | Address queries, map tile requests | US |
Authentication
| Provider | Purpose | Data Processed | HQ Location |
|---|
| Google OAuth | Social login (Google accounts) | Email, name, profile picture (when user chooses social login) | US |
| Apple Sign-In | Social login (Apple accounts) | Email, name (when user chooses social login) | US |
AI & Machine Learning (Opt-In Only)
AI features are disabled by default. Restaurant operators enable them through
dashboard settings. Where an operator enables a feature that requires it,
personal data may be processed by these providers solely to return outputs to
the Service. Account-specific data-processing terms, training settings and
transfer safeguards require verification; this list does not certify an
unverified account or agreement. Features that do not require personal data
receive only operational data (menu items, descriptions, business queries).
| Provider | Purpose | Data Processed | HQ Location |
|---|
| Google AI (Gemini) | Menu digitisation, operational insights | Menu data, item descriptions | US |
| OpenAI | AI-powered features | Operational queries, menu data | US |
| Anthropic (Claude) | AI-powered features | Operational queries, menu data | US |
| Perplexity AI | Research and employee onboarding assistance | Employee text supplied by the operator, which may include names, contact details and employment data | US |
Integration Partners
| Provider | Purpose | Data Processed | HQ Location |
|---|
| DA592 LTD, trading as Masheev | Partner platform integration | Reservation data and guest data on restaurant instructions; the configured organisation region determines EU or US processing | UK contracting entity; EU/US hosting |
Data Protection
Suitable data-processing terms and any required international-transfer mechanism
must be verified for each actual service and account. This provider list is not
proof of an executed agreement, account binding, no-training setting or transfer
assessment. Account-specific contract, training and transfer verification
remains pending where supporting evidence has not been recorded. An agreement
naming DA592 LTD does not establish coverage for the distinct TABLEPORT LTD
entity.
For details, see our International Data Transfers page.
Changes and Objections
To be notified of sub-processor changes, ensure your business admin email is up
to date in your TablePort dashboard. To object to a new sub-processor, email
[email protected] within 30 days of notification.
Contact
TablePort LTD Email: [email protected]