ComidaQR
    Legal centre

    Legal

    Subprocessor Register

    The providers that process personal data so ComidaQR can run, and what each one receives.

    Last updated October 16, 2026

    In short

    1. Six providers, each limited to one job.
    2. Hosting and most providers are in the United States, under Standard Contractual Clauses.
    3. OpenAI only receives what a restaurant's AI features need, and only when the restaurant uses them: menu content, and for the owner assistant the figures a question needs, which can include guests' names and notes.
    4. We will update this page before adding or replacing a provider.

    A summary to help you read. The full text below is what applies.

    How we choose and change providers

    Every provider below is bound by a contract that limits what it may do with personal data. We will update this register before a new provider starts processing personal data, and customers can object as described in our Data Processing Agreement.

    • Replit, Inc.

      United States
      What it does
      Application hosting, PostgreSQL database, file storage (backed by Google Cloud Storage), sign-in, and the connection to our AI and email providers.
      Data it receives
      All personal data processed by the service.
      Transfer safeguard
      Standard Contractual Clauses

    • Stripe

      Ireland and United States
      What it does
      Subscription billing for restaurants, and diner card payments through Stripe Connect.
      Data it receives
      Owner name and billing email, payment method details, invoices; diner card details and optional receipt email.
      Transfer safeguard
      Standard Contractual Clauses; Data Privacy Framework

    • Resend

      United States
      What it does
      Sending emails: account, trial and billing notices, booking confirmations, data export links.
      Data it receives
      Recipient email address and message content.
      Transfer safeguard
      Standard Contractual Clauses

    • OpenAI

      United States
      What it does
      AI menu import, automatic translation, dish image generation and the owner assistant's answers, only when a restaurant uses those features. Accessed through Replit.
      Data it receives
      Menu text and photos the restaurant submits. For the owner assistant, the figures a question needs, which can include a guest's name, party size and booking time, a pickup order's name, and guests' private notes. Never email addresses or phone numbers.
      Transfer safeguard
      Standard Contractual Clauses

    • Google Cloud (via Replit)

      United States
      What it does
      Storage behind Replit's file storage.
      Data it receives
      Uploaded photos and files, data export archives.
      Transfer safeguard
      Standard Contractual Clauses; Data Privacy Framework

    • Sentry (Functional Software, Inc.)

      United States
      What it does
      Error monitoring, so we can find and fix faults.
      Data it receives
      Technical error details and a pseudonymous user ID. No names or emails are sent.
      Transfer safeguard
      Standard Contractual Clauses; Data Privacy Framework

    Questions about this document?

    Write to legal@comidaqr.com.

    Other legal documents