What a sub-processor is
A sub-processor is a third party we engage to help us provide the marketplace and that, in doing so, processes personal data — for example our hosting and database provider, our payment processor, the email sender, and the AI model providers that power the AI-chat plugin. Tóg remains responsible for the data each of these handles on our behalf, under the terms of our Data Processing Addendum.
The list below is complete as of the effective date and contains only providers that are actually part of our stack. We do not list providers we have not engaged.
The current list
| Sub-processor | Purpose | Data processed | Region |
|---|---|---|---|
| Google Cloud / Firebase (Google LLC) | Primary application data store and identity: Cloud Firestore (database), Firebase Authentication (account sign-in), and Cloud Storage. Also Vertex AI (Gemini) when the Tóg-paid AI model path is used. | All tenant account data, configuration, and plugin-collected end-shopper data (loyalty members, reviews, bookings); authentication credentials; AI prompt/response content when the Vertex path serves a request. | Firestore: europe (eur3, EU multi-region). Vertex AI: europe-west1 by default. |
| Vercel Inc. | Application hosting and edge delivery for the marketplace, and the Vercel AI Gateway that routes AI-chat requests to the configured model. | HTTP request/response data and operational logs; for AI-chat via the gateway, the chat prompt and the model's reply transit Vercel. | United States (with global edge). Transfers governed by SCCs — see the DPA. |
| Stripe, Inc. | Subscription billing and payment card processing for marketplace plans. | Billing contact and subscription metadata; payment card details are entered with and held by Stripe — Tóg never receives or stores card numbers. | United States / EU. Transfers governed by SCCs — see the DPA. |
| OpenAI, L.L.C.Used only when AI-chat is enabled and OpenAI is the active model provider. | Large-language-model responses for the AI-chat plugin when OpenAI is the selected provider — either on the tenant's own (BYO) OpenAI key or the Tóg-paid path. | The chat conversation content (end-shopper messages and any image a shopper attaches) for the request being answered. | United States. Transfers governed by SCCs — see the DPA. |
| Anthropic, PBCUsed only when AI-chat is enabled and the gateway (Claude) path is active. | Claude large-language-model responses for the AI-chat plugin, served through the Vercel AI Gateway (the default Tóg-paid model path). | The chat conversation content for the request being answered. | United States. Transfers governed by SCCs — see the DPA. |
| Resend (Plus Five Five, Inc.)Active only when email is configured (RESEND_API_KEY present). | Transactional email delivery — booking confirmations, loyalty notifications, and AI-chat human-handoff alerts — sent from support@togs.ie. | Recipient email address and the message content (e.g. a booking confirmation or a handoff summary). | United States. Transfers governed by SCCs — see the DPA. |
| Twilio Inc.Listed for completeness — engaged only where a tenant enables SMS with their own Twilio key. Platform-level SMS is built but not yet activated. | SMS delivery for plugins/tenants that enable SMS using their own Twilio credentials. | Recipient phone number and the SMS message content. | United States. Transfers governed by SCCs — see the DPA. |
Several entries are conditional: the AI model providers (OpenAI, Anthropic) are engaged only when a tenant has the AI-chat plugin enabled and that provider is the active model path; Resend is engaged only when transactional email is configured; and Stripe is engaged when a paid plan is in use. The status note in each row sets out when that provider actually receives data.
Bring-your-own-key: providers you choose
Several plugins are designed so that the tenant supplies their own account credentials for an upstream provider — for example a tenant’s own OpenAI API key for the AI-chat plugin, or their own Twilio credentials for SMS where enabled. When a tenant uses their own key:
- the relationship with that provider is the tenant’s own — governed by the agreement between the tenant and that provider, including that provider’s data-use, retention and any model-training terms;
- Tóg uses the tenant’s key only to make the specific call the plugin needs (for AI-chat, to send that chat request to the model and return the reply). The key is stored encrypted at rest and is never logged or returned — see our Security page;
- that provider is the tenant’s own sub-processor under their own data-protection arrangements, not one we engage on the tenant’s behalf.
The default AI-chat path uses Tóg-paid providers (the Vercel AI Gateway routing to Anthropic Claude, or Google Vertex Gemini), which we list above as our sub-processors. The full breakdown of what content goes where is on the AI Data Handling page.
Where the data lives
Our primary data store — Cloud Firestore, holding all tenant account data and the end-shopper data plugins collect (loyalty members, reviews, bookings) — is hosted in the European Union (the eur3 EU multi-region), and the Tóg-paid Vertex AI path runs in europe-west1 (EU). Several sub-processors above (Vercel, Stripe, OpenAI, Anthropic, Resend, Twilio) are established in the United States, so data sent to them is an international transfer. The detail — and what EU residency means for non-EU merchants — is on the Data Residency page.
International transfers. Where a sub-processor is outside the EU/EEA, the transfer is intended to be governed by the appropriate safeguards under the GDPR. [OWNER: Confirm reliance on the EU Standard Contractual Clauses (and the UK Addendum / Swiss adequacy if relevant) for the US sub-processors, and who signs them]
Notice of changes
Our change-notice commitment
We will keep this list current and dated. Before we add a new sub-processor or materially change how an existing one is used in a way that affects the processing of personal data, we will update this page (with a new effective date and version) and give tenants advance notice in line with our Data Processing Addendum, so a tenant who objects has the opportunity to do so.
[OWNER: Confirm the exact advance-notice period for sub-processor changes (e.g. 14 or 30 days) and the objection mechanism, to match the DPA]
To be notified of changes, or to ask a question about any sub-processor, email support@togs.ie.