Subprocessors
BookingAPI uses the following service providers and subprocessors to host, secure, support, bill, communicate, automate and operate the Service. This page is referenced by our Privacy Policy and is updated when a provider or the production AI model changes.
Last updated: July 4, 2026
| Provider | Purpose | Processing location |
|---|---|---|
| Meta Platforms, Inc. | WhatsApp Cloud API messaging, WhatsApp Business onboarding, Facebook Login for Business, Embedded Signup, deauthorization and Meta data-deletion flows. | United States and other Meta processing locations |
| OpenAI, L.L.C. | AI reply generation for the WhatsApp AI Agent and AI-assisted onboarding/business-profile generation. Current production model: gpt-4o (OpenAI API; API data is not used for model training). | United States and other OpenAI processing locations |
| Google LLC | Google sign-in, OAuth, Google Calendar integration and calendar sync. | United States, Canada, and other Google processing locations |
| Stripe, Inc. | Payments, billing, invoices, card processing, fraud prevention, Stripe Connect and connected-account onboarding. | United States and other Stripe processing locations |
| Resend (Plus Five Five, Inc.) | Email delivery for operational and administrative emails. | United States and other Resend processing locations |
| Cloudflare, Inc. | Website and dashboard hosting (Cloudflare Pages), CDN, tunnel (which terminates TLS and applies WAF inspection to traffic in transit), security and traffic protection. Performance analytics and real-user monitoring only if enabled — not currently deployed. | Cloudflare's global network (routing may traverse points of presence inside or outside Canada and the United States) |
| Amazon Web Services, Inc. | Encrypted off-site database backup storage (Amazon S3) and cloud key management (AWS KMS), which wraps and unwraps the master key protecting field-encrypted personal information. Backups are encrypted before upload with a separate key that AWS does not hold, so AWS cannot read backup contents. | Canada Central region (ca-central-1) for both S3 and KMS |
Separately from the third-party providers above — and not as a subprocessor — the core of the Service (backend application containers, the PostgreSQL database, internal services and the local encrypted backup mirror) runs on physical server hardware that BookingAPI owns and operates in Canada. No third party operates these systems or holds administrative access to them.
Questions about our subprocessors or data handling? Contact [email protected].