Subprocessors
Last updated: 31 July 2026
BookMe AI uses the following subprocessors to provide BookMe AI. Each subprocessor is bound by a written data processing agreement meeting GDPR Article 28(3), and international transfers are protected by the EU-U.S. Data Privacy Framework or the 2021 EU Standard Contractual Clauses.
We notify customers at least 10 business days before adding or replacing a subprocessor. Customers may object within 30 days as described in our Data Processing Agreement.
Meta Platforms Ireland Limited (WhatsApp Business Platform)
- Purpose
- Sending and receiving WhatsApp messages between your customers and BookMe AI
- Data accessed
- Message content, phone numbers, WhatsApp Business Account credentials
- Location
- Ireland (global infrastructure)
- Safeguards
- EEA contracting entity; Meta transfer mechanisms (SCCs)
Google LLC — Gemini API
- Purpose
- AI understanding of customer messages and generation of scheduling replies
- Data accessed
- WhatsApp message text
- Location
- United States
- Safeguards
- EU-U.S. Data Privacy Framework; paid API tier — data not used for model training
Google LLC — Calendar API
- Purpose
- Checking availability and creating appointment events in your calendar
- Data accessed
- Customer name, phone number, appointment times
- Location
- United States (global)
- Safeguards
- EU-U.S. Data Privacy Framework
OpenAI, L.L.C.
- Purpose
- Alternative AI provider, only when your account is set to use OpenAI
- Data accessed
- WhatsApp message text (same scope as Gemini)
- Location
- United States
- Safeguards
- EU-U.S. Data Privacy Framework; API data not used for model training
Supabase, Inc.
- Purpose
- Database hosting for conversations, appointments, and account configuration
- Data accessed
- All stored tenant and end-customer data
- Location
- United States (data stored in EU — Dublin, Ireland)
- Safeguards
- EU data residency; EU-U.S. Data Privacy Framework
Vercel, Inc.
- Purpose
- Application hosting and serverless compute
- Data accessed
- Data in transit during webhook/API processing; transient request logs
- Location
- United States
- Safeguards
- EU-U.S. Data Privacy Framework
Twilio Inc.legacy only
- Purpose
- Legacy WhatsApp integration path for tenants connected before the Meta Cloud API migration
- Data accessed
- Message content and phone numbers (legacy tenants only)
- Location
- United States
- Safeguards
- EU-U.S. Data Privacy Framework; not used for new tenants
Billing for your BookMe AI subscription is handled by Revolut. Revolut processes your business's billing data with BookMe AI acting as controller and is therefore covered by our Privacy Policy, not this list.
Questions: security@bookmeai.app