Sub-processors
Last updated: 9 November 2026
These companies process the diner data we hold for restaurants, on our behalf and under written contracts that meet Article 28 of the UK GDPR. We will tell each venue's Owner by email, and update this page, at least 30 days before we add or replace a sub-processor, as set out in our Data Processing Addendum.
A. Sub-processors
| # | Sub-processor | What it does for us | Diner data it processes | Where | Transfer safeguard |
|---|---|---|---|---|---|
| 1 | Supabase Pte. Ltd. (Supabase) | Database, sign-in and file storage for the Service | All diner data in the Service | Amazon Web Services, London (eu-west-2). Supabase's own staff and sub-processors may access it from other countries to operate and support the service | Supabase's DPA, with the EU standard contractual clauses and the UK Addendum |
| 2 | Vercel Inc. (Vercel) | Hosting both TableGo applications | Data passing through the Service as it is used, and application logs | Server functions in London; requests travel through Vercel's global edge network; Vercel is based in the United States | Vercel's DPA, and the UK Extension to the EU–US Data Privacy Framework |
| 3 | Plus Five Five, Inc. (Resend) | Sending service emails: confirmations, reminders, receipts, review requests and booking notifications | Recipient email address and name, and the content of the email (booking or order details) | United States; email and log data kept for 30 days | Resend's DPA, with the EU standard contractual clauses and the UK Addendum; Resend is also listed under the UK Extension to the EU–US Data Privacy Framework |
| 4 | Amazon Web Services EMEA SARL (Amazon Web Services) | Sending Marketing campaigns (Amazon Simple Email Service) and carrying their delivery events (Amazon EventBridge, Amazon SQS) | Recipient email address, campaign content, sender details, delivery, bounce and spam-report events | London (eu-west-2). Amazon may store and scan email sent through the service to protect it from abuse; Amazon does not say where | AWS DPA with the AWS UK GDPR Addendum; Amazon is also listed under the UK Extension to the EU–US Data Privacy Framework |
| 5 | OpenAI OpCo, LLC (OpenAI) | Drafting a suggested reply to a review, only when a venue's team asks for one | The name shown on the review, its rating and its text, and the venue's details | United States. OpenAI keeps abuse-monitoring logs for up to 30 days and does not use this data to train its models | OpenAI's DPA, with the EU standard contractual clauses and the UK Addendum |
B. Other organisations that receive diner data (not sub-processors)
| Organisation | Why it receives diner data |
|---|---|
| Stripe | Processes deposits, card guarantees and voucher and ticket payments through each venue's own Stripe account, under Stripe's terms with the venue |
| When a diner books a venue on Google through Reserve with Google, Google sends us the booking and we send its status back. Google acts under its own terms | |
| OpenAI (ChatGPT app) | When someone uses the TableGo app in ChatGPT, we send back public restaurant information, available times and booking links. No diner personal data is sent |
C. Changes
To object to a new sub-processor, reply to our notice email or write to support@tablego.uk within the 30 days.