Subprocessors
A subprocessor is a third-party provider Waine engages to process personal data on behalf of business customers, in order to deliver the service. Below is the current list.
| Provider | Purpose | Data type | Region | Basis |
|---|---|---|---|---|
| Stripe | Payment processing, subscription billing | Payment card details, billing information | United States | Necessary |
| Twilio | SMS delivery (appointment reminders, verification codes) | Phone number, message content | United States | Necessary |
| Resend | Transactional email delivery | Email address, message content | United States | Necessary |
| Resend (Newsletter) | Marketing newsletter mailing list — only for visitors who opt in | Email address | United States | Consent |
| Railway | Application hosting; managed database and cache/queue | All application data | United States | Necessary |
| Cloudflare (R2) | Object storage for uploaded files (logos, avatars, documents) | Uploaded files | United States | Necessary |
| Sentry | Error tracking and monitoring | Technical diagnostic data, which may include user identifiers in error context | United States | Necessary |
| Google (Calendar) | Google Calendar sync | Calendar data | United States | Necessary |
| Microsoft (Calendar) | Microsoft 365 / Outlook Calendar sync | Calendar data | United States | Necessary |
| Zoom | Video meeting creation for virtual appointments | Client name, service name, appointment time (used as the meeting topic and schedule) | United States | Necessary |
| OpenAI | AI support-agent chat, campaign copy assistance, and admin diagnostic tools | Text entered into the AI support chat, plus related appointment details where applicable; for the diagnostic tools, no personal client data | United States | Necessary |
| Expo (Expo Application Services) | Mobile push notification delivery | Device push token, notification content | United States | Necessary |
| Google Analytics | Website analytics | Website usage data | United States | Consent |
| Microsoft Clarity | Website analytics (session replay, heatmaps) | Website usage and interaction data | United States | Consent |
| Meta (Pixel & Conversions API) | Advertising analytics and ad conversion measurement | Website usage data; hashed email/phone (for ad matching) on signup and checkout events | United States | Consent |
“Necessary” vs. “Consent”
Providers marked “Necessary” process data to operate the service itself (payments, SMS, email, hosting, storage, sign-in) and run for every visitor or customer, regardless of the cookie banner.
Providers marked “Consent” only receive data after a separate, voluntary action on your part. For website analytics tools, that means clicking “Accept all” on the cookie banner — if you choose “Necessary only” or don't respond, no data (including calls our servers make) is sent to them at all. For the newsletter, that means signing up yourself on the newsletter form — never automatically.
Changes to this list
We update this page whenever a subprocessor is added, removed, or changed. For a material change affecting how a business's client data is processed, we notify business owners by email where practical before the change takes effect.
Contact us
For questions about this list or our subprocessors: privacy@waineappointments.com
Effective September 9, 2026. This page is provided for information and does not constitute legal advice.