Transparency
Sub-Processors
We use the following third-party service providers to operate the Spas & Springs platform. Each sub-processor is bound by a Data Processing Agreement (DPA).
Last Updated: March 2026
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Stripe, Inc. | Payment processing, marketplace payouts (Stripe Connect) | Name, email, payment card details (tokenized), billing address, transaction history | United States |
| Cloudflare, Inc. | CDN, edge hosting, object storage (R2), caching (KV), bot protection (Turnstile), analytics, search (Vectorize) | IP address, request metadata, uploaded files, search queries, analytics events | United States (Global Edge) |
| Resend, Inc. | Transactional and marketing email delivery | Email address, email content, delivery metadata | United States |
| Twilio, Inc. | SMS notifications for booking confirmations and alerts | Phone number, SMS message content | United States |
| Google LLC (Firebase) | Mobile push notifications (Firebase Cloud Messaging) | Device tokens, notification content | United States |
| Anthropic, PBC | AI-powered recommendations, review moderation, concierge chat | Search queries, review text, chat messages (anonymized where possible) | United States |
| Mapbox, Inc. | Map rendering and geolocation services | IP address, location coordinates, map interactions | United States |
| Functional Software, Inc. (Sentry) | Error tracking and performance monitoring | Error logs, stack traces, device/browser metadata (no PII) | United States |
Purpose: Payment processing, marketplace payouts (Stripe Connect)
Data: Name, email, payment card details (tokenized), billing address, transaction history
Location: United States
Purpose: CDN, edge hosting, object storage (R2), caching (KV), bot protection (Turnstile), analytics, search (Vectorize)
Data: IP address, request metadata, uploaded files, search queries, analytics events
Location: United States (Global Edge)
Purpose: Transactional and marketing email delivery
Data: Email address, email content, delivery metadata
Location: United States
Purpose: SMS notifications for booking confirmations and alerts
Data: Phone number, SMS message content
Location: United States
Purpose: Mobile push notifications (Firebase Cloud Messaging)
Data: Device tokens, notification content
Location: United States
Purpose: AI-powered recommendations, review moderation, concierge chat
Data: Search queries, review text, chat messages (anonymized where possible)
Location: United States
Purpose: Map rendering and geolocation services
Data: IP address, location coordinates, map interactions
Location: United States
Purpose: Error tracking and performance monitoring
Data: Error logs, stack traces, device/browser metadata (no PII)
Location: United States
Data Processing Agreements
We maintain Data Processing Agreements (DPAs) with each sub-processor listed above, in accordance with GDPR Article 28 requirements. For international data transfers, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission. If you have questions about our sub-processors or wish to receive copies of relevant DPAs, please contact dpo@spasandsprings.com.
See our Privacy Policy for more information about how we handle your data.