Subprocessors
Last reviewed 29 September 2026
These are the suppliers that process personal data on our behalf when you use DogBoarder, what each one does, where it does it, and the safeguard that applies where data leaves the United Kingdom. This list is referred to by clause 7 of our data processing agreement and forms part of it. No other supplier processes personal data inside the product. Email you send us takes a different route, and it is set out below rather than left implied.
| Subprocessor | What for | Where processed and stored | Transfer mechanism |
|---|---|---|---|
| Neon | Database hosting — your records, and their continuous backups. | London, United Kingdom (AWS eu-west-2). | None required: data stays in the United Kingdom. |
| Railway | Application hosting — the servers DogBoarder runs on. | EU West. | United Kingdom adequacy regulations for the European Economic Area; no transfer outside the UK or EEA. |
| Cloudflare | File storage (uploaded documents and photos), DNS and network, cookie-free web analytics on the public pages only, and inbound email routing for hello@dogboarder.uk — the address our privacy notice and data processing agreement give for support, rights requests, breach notices and objections to this list. | Files: Cloudflare R2 under EU jurisdiction. DNS, network, analytics and email routing: handled at Cloudflare’s edge nearest the visitor or sender. Mail addressed to hello@dogboarder.uk is forwarded on to our own mailbox. | Storage stays in the EU. Cloudflare’s data processing addendum, incorporating the EU Standard Contractual Clauses and the UK Addendum, covers any edge processing outside the UK or EEA. |
| Stripe | Payments — your subscription to us, and the payments your clients make to you through your own Stripe account. Contracting entity for the UK is Stripe Payments UK Ltd. | United Kingdom and European Economic Area. | For card data Stripe is a controller in its own right, under its own privacy policy, not our processor. For anything it processes on our behalf, Stripe’s data processing agreement applies. |
| Resend | Transactional email — sign-in links, booking reminders, inspector access grants, waitlist offers and the copy of each pilot or waitlist application sent to our team, sent from send.dogboarder.uk. | Dispatched from Ireland (eu-west-1). Message content, metadata and delivery logs are stored in the United States, whatever sending region is chosen. | UK Addendum to the EU Standard Contractual Clauses, incorporated in Resend’s data processing agreement, and Resend’s certification to the EU-U.S. Data Privacy Framework, UK extension. |
| Sentry | Error monitoring. | European Union (EU-hosted ingest). Personal data is stripped before anything is sent. | United Kingdom adequacy regulations for the European Economic Area; no transfer outside the UK or EEA. |
| Sign-in with Google when a user chooses it. Google Calendar can also fetch a private booking-calendar feed when an administrator chooses to subscribe to it. | Determined by Google. | Google is a controller in its own right under its own privacy policy. For sign-in, we receive only the email address and name it confirms. For a calendar subscription, Google receives only the entries in the private feed; DogBoarder receives no access to the Google calendar. | |
| Microsoft | Sign-in with Microsoft when a user chooses it. Outlook can also fetch a private booking-calendar feed when an administrator chooses to subscribe to it. | Determined by Microsoft. | Microsoft is a controller in its own right under its own privacy policy. For sign-in, we receive only the email address and name it confirms. For a calendar subscription, Microsoft receives only the entries in the private feed; DogBoarder receives no access to the Outlook calendar. |
The one that leaves the UK
Resend is the only supplier on this list that stores your data outside the United Kingdom and the European Economic Area. Its sending region controls where email is routed and sent from, not where it keeps the record of having sent it: message content, metadata and delivery logs are stored in the United States whichever region is chosen. For DogBoarder that means the address a sign-in link went to, and the text of a booking reminder, which can name a dog and list what is missing from its profile. We verified this against Resend's published documentation on 29 September 2026 and would rather say it plainly than describe email as “in the EU” because it is dispatched from Ireland.
Correspondence you send us
Email to hello@dogboarder.uk does not travel through the product, so it is worth saying where it goes. Inbound mail for dogboarder.uk is handled by Cloudflare Email Routing, which forwards it to the company's own mailbox — that is the route a support question, a rights request under the data processing agreement, a breach notice or an objection to this list takes. What you write to us therefore sits in an inbox as well as in the table above, and our privacy notice says the same thing more briefly: if you email us, we keep the email.
How changes are notified
Before we add a subprocessor or replace one, we email the administrators of every organisation account at least 14 days before the change takes effect. If you object on reasonable data protection grounds and we cannot resolve it, you may terminate without penalty before the change takes effect — clause 7 of the data processing agreement sets this out. Removing a subprocessor, or a change to what an existing one does that does not add to the data it sees, is reflected here without notice.
Questions
Anything about this list, including an objection, goes to hello@dogboarder.uk. The security and data residency page has the fuller picture of where your data lives and what protects it.