Legal
Service Providers (Subprocessors)
Draft — pending legal review.This text describes how HalallO works today but has not been reviewed by a lawyer. Details in [brackets] are still to be filled in.
The companies that help us run HalallO and process personal data on our behalf. “Planned” means not yet in use.
1.Providers
| Provider | Purpose | Data | Location | Status |
|---|---|---|---|---|
| Supabase, Inc. | Database, authentication, file storage, server functions | All account, claim, listing, app and waitlist data | United States (AWS us-east-1) | Used |
| Amazon Web Services, Inc. | Infrastructure under Supabase | As above (encrypted at rest) | United States | Used, through Supabase |
| Vercel, Inc. | Hosting and delivery of halallo.com and business.halallo.com | Request logs (IP address, browser, pages) | Global edge network; United States | Used |
| Resend (Plus Five Five, Inc.) | Sending email: verification codes, waitlist confirmations and service messages | Email address, message content | United States | Used |
| Cloudflare, Inc. (Turnstile) | Bot protection on sign-in, sign-up, password reset and the waitlist | Browser and device signals, IP address | Global | Used when the security check is switched on |
| 650 Industries, Inc. (Expo) | Push notifications and app updates (app) | Push token, device platform, notification content | United States | Used (app) |
| Apple Inc. / Google LLC | Push delivery (APNs, Firebase Cloud Messaging); optional sign-in; maps in the app | Push token; sign-in identifiers if you choose them | United States | Used (app) |
| Stripe, Inc. / Stripe Payments Europe, Ltd. | Payments, invoices, tax calculation | Billing name and address, card details (held by Stripe), invoices | United States, Ireland | Planned, with billing |
| PostHog, Inc. (EU Cloud) | Product analytics with an opt-out | Pseudonymous usage events | European Union (Frankfurt) | Planned |
| Twilio Inc. (Verify) | Verification codes by phone for restaurant claims | Phone number on the listing, code | United States | Planned |
2.Safeguards
Each provider processes data only on our instructions under a data processing agreement, with security measures appropriate to the data. Where data leaves the EEA, UK or Switzerland, we rely on the EU–US Data Privacy Framework where the provider is certified, or on Standard Contractual Clauses (and the UK addendum).
3.Changes
We update this page before a new provider starts processing personal data. Business customers who want to be told about changes can email business@halallo.com. More in the Business Privacy Notice and the Privacy Policy.