These are the third parties we use to provide the Service that process personal data on our customers’ behalf. This list is Annex 3 of our Data Processing Addendum. Where a provider is outside the UK and the European Economic Area, the transfer is covered by the safeguards in section 7 of the DPA.
Sub-processors
| Provider | Purpose | Region |
|---|---|---|
| Fly.io, Inc. | Application hosting. | United Kingdom (London) |
| Cloudflare, Inc. | Content delivery, application hosting and security. | United States and worldwide |
| Supabase, Inc. | Database, file storage and account sign-in. | European Union (Ireland) |
| Resend (Plus Five Five, Inc.) | Sending emails. | United States |
| OpenAI, L.L.C. | AI Features: review-reply drafts and dish image generation. | United States |
| Anthropic, PBC | AI Features: AI menu import. | United States |
| DeepL SE | Menu translation. | European Union (Germany) |
| Google LLC (Google Fonts) | Delivers web fonts. | United States and worldwide |
Sign-in providers
These are used only where we offer them and only when a user chooses to sign in with them. The provider also handles the sign-in under its own terms.
| Provider | Purpose | Region |
|---|---|---|
| Google LLC (Sign in with Google) | Signing in with a Google account, where offered and when the user chooses it. | United States and worldwide |
| Apple Inc. (Sign in with Apple) | Signing in with an Apple account, where offered and when the user chooses it. | United States and worldwide |
Not sub-processors
- Stripe (Stripe Payments Europe, Ltd. and its affiliates) processes our customers’ subscription payments. It acts as a controller of payment data in its own right, under its own privacy policy. It does not process Diner Data.
- Our own website analytics. When enabled, we count visits to our own marketing and sign-up pages with Umami, which we run ourselves on a server we control. It is never used on restaurants’ menu pages and does not process Diner Data.
- Tags a restaurant adds to its menu. A restaurant can add its own Google Analytics, Google Tag Manager or Meta Pixel to its menu. They load only after the Diner accepts analytics cookies. These providers work for the restaurant, not for us, and the restaurant is responsible for them.
- Review sites a restaurant links to, such as Google reviews, are visited by Diners directly and are not our sub-processors.
Changes to this list
We update this page at least 14 days before a new sub-processor starts processing Customer Personal Data. To object to a new sub-processor, email legal@octopusmenu.com within that period, as set out in section 5 of the DPA.