Subprocessors
Every third party that can touch spa or guest data, what it does, and where it operates. We give 30 days’ notice before adding a new one.
| Vendor | Purpose | Data involved | Region |
|---|---|---|---|
| Lovable Cloud (Supabase / AWS) | Application hosting, database, authentication, file storage | Accounts, bookings, customer records, staff records, notes | Managed cloud infrastructure |
| Cloudflare | Domain registrar, DNS, CDN, bot protection (Turnstile) | Domain records, IP addresses, request metadata | Global edge network |
| Purelymail / Migadu | Mailbox hosting for spa email addresses | Email messages and mailbox contents | European Union |
| Resend | Transactional email delivery for spa notifications | Recipient email address, message content | United States / European Union |
| Twilio | SMS delivery for verification codes and booking reminders | Phone number, message content | Global |
| Google (Calendar API, optional) | Calendar mirroring, only when a staff member connects their account | Booking time, service name, assigned staff | Global |
Questions about this list: privacy@bestbalispas.com · PT BagusTech, Jalan Raya, Denpasar, Bali, Indonesia