Reservly Sub-Processor List

Last updated: July 12, 2026

What is a sub-processor?

A sub-processor is a third-party service that Reservly uses to operate the platform. Where those services store, transmit, or otherwise process personal data on Reservly's behalf, the GDPR and similar laws classify them as sub-processors. The businesses that use Reservly are controllers of their customers' personal data; Reservly is a processor acting on each business's behalf; the services listed below are sub-processors engaged by Reservly.

This page lists every sub-processor we currently use, plus services we expect to activate in the near term. We keep the list current because the businesses we serve often need it to satisfy their own compliance programs.

Current sub-processors

Core platform infrastructure

‡ For UK personal data transferred to US-based sub-processors (Vercel): the applicable transfer mechanism is the ICO-approved IDTA or UK Addendum to EU SCCs. Where a US-based sub-processor is certified under the UK-US Data Bridge, Reservly may rely on that certification in lieu of the IDTA for that specific transfer. Certification status will be verified per vendor before UK customer onboarding.

Communication and monitoring

Push notification delivery

Reservly does not choose which of these three services is used for a given device — the recipient's browser makes that determination when the device subscribes to push notifications. This feature is used to notify business staff/owners of new bookings on their own devices; it is not used to send push notifications to end-user customers.

SMS delivery (business-connected "bring your own" Twilio)

Billing (Reservly's own subscriptions)

Customer-to-business payments (Reservly is software-only)

Reservly is software-only. Reservly does not hold customer funds, does not maintain a master merchant account, and is not a Payment Facilitator, Payment Services Provider, Money Transmitter, or Merchant of Record under any regulatory definition (including PSD2, the UK Payment Services Regulations, FinCEN, US state money-transmitter laws, or the Mastercard / Visa Payment Facilitator registries). When a business using Reservly accepts payments from its customers through Stripe, Stripe processes payment data on the business's instruction — not Reservly's instruction. This means Stripe is not Reservly's sub-processor in this flow; it is an independent data processor engaged directly by the business through the business's own Stripe Connect Standard account. The business, as the merchant of record, has its own contractual relationship with Stripe and is responsible for Stripe's data-processing practices in the customer-facing payment flow.

Reservly lists this provider here for transparency, because the OAuth connect flow passes through Reservly's infrastructure and Reservly stores minimal payment-adjacent reference data (transaction IDs, as described in the Privacy Policy). The customer personal data processed during payment itself — card details, billing address, bank account information — is governed solely by the business's agreement with Stripe, not by Reservly's DPA.

The following table describes this relationship for transparency. Stripe is not Reservly's sub-processor; it is listed because Reservly stores OAuth tokens that link a business's account to Stripe.

Planned sub-processors

These services are contracted or under evaluation and will appear in the "Current" tables above on the date they begin processing live data. We will announce each activation through the notice process described below at least 30 days in advance.

How we manage sub-processor changes

We maintain a Data Processing Agreement or equivalent contract with every sub-processor that processes personal data on our behalf, and we rely on Standard Contractual Clauses or an equivalent transfer mechanism for international transfers where required.

We review each sub-processor's data-processing practices, DPA status, and region at least annually. The Last updated date at the top of this page reflects the most recent review cycle. Individual sub-processor rows do not show per-row review dates; all rows were verified as of the most recent Last updated date unless otherwise noted.

When we propose to add a new sub-processor or materially change an existing one, we will post the change on this page and send notice to the primary contact email on every active subscription at least 30 days before the change takes effect, unless a shorter period is required by law or by a security-critical incident. During that window, a business may object to the change by emailing support@reservly.io. If we cannot accommodate the objection, the business may terminate its subscription and receive a pro-rated refund of any prepaid fees for the remaining service period.

Subscribe to change notifications

Businesses with active subscriptions receive sub-processor change notices automatically at the primary contact email.

Other parties (prospective customers, auditors, procurement teams) may subscribe to change notifications by emailing support@reservly.io with the subject line "Sub-processor list subscribe" and we will add the address to the notice list. You may unsubscribe at any time with the subject line "Sub-processor list unsubscribe."

We plan to add an RSS feed for this page in a future update; when available, it will be linked here.

Changelog

This section records every material change to the list above, in reverse chronological order.

Contact

Questions about any sub-processor, a specific transfer, or our sub-processor program generally: support@reservly.io.

Formal data-protection inquiries (data subject requests, regulator correspondence): support@reservly.io with subject line "Privacy Officer" — routed to Reservly's designated Privacy Officer role.