Sub-processors
This translation is provided for convenience; the English version governs.
Governing text: English. Translations into other languages, Arabic included, are for convenience.
Last updated: 16 October 2026
These are the sub-processors STAK uses to process the personal data that businesses keep in STAK, as listed in Annex 3 of the Data Processing Agreement.
STAK announces a new sub-processor within the app or by email at least 30 days before it starts processing that data, and each business may object (Data Processing Agreement, clauses 6.3 and 6.4).
The providers STAK uses for its own account data, such as sign-in and billing, are listed in clause 4.1 of the Privacy Policy.
| Sub-processor | Purpose | Location of Processing | When used | How long it keeps the data |
|---|---|---|---|---|
| Amazon Web Services (Amazon Web Services EMEA SARL) | Hosting, databases, file storage, Backups and encryption keys | Germany (Frankfurt) for the Production environment and Backups; Ireland for copies of the Backups | Always | Under clause 12 |
| Cloudflare (Cloudflare, Inc.) | Web application firewall, protection against denial-of-service attacks, domain name system and connection encryption | Global network | Always | Holds Customer Data only transiently while network traffic passes through |
| Anthropic (Anthropic, PBC) | AI Features, such as the Staki assistant and receipt reading | United States of America | Only when AI Features are used | Deletes inputs and outputs within 30 days of receiving or generating them, except what it keeps longer, for up to two years, to check for breaches of its usage policies, or what the law requires it to keep. It does not use them to train its models |
| Google (Google Workspace) | Sending the email that the Customer sends to its End Customers and Users through the Services, from [email protected] | United States of America and the other countries where Google operates data centres | When an email is sent through the Services | Keeps a copy of each message in STAK's mailbox until STAK deletes it under clause 12 |
Providers used only when switched on. STAK has the following providers set up but does not use them to Process Customer Personal Data today. It starts using any of them only after giving notice under clause 6.3, at least 30 days in advance, and the notice states where the provider Processes the data and how long it keeps it.
| Provider | Purpose |
|---|---|
| Resend (Resend, Inc.) | Sending email through the Services, in place of or alongside Google Workspace |
| Twilio (Twilio Inc.) and Unifonic | Sending the text messages the Customer sends through the Services |
| Expo (650 Industries, Inc.) | Delivering push notifications to the owner app |
| Apple (Apple Wallet) and Google (Google Wallet) | Loyalty cards that End Customers add to their phone wallets |
Once STAK switches on its own WhatsApp number, Meta sends from it sign-in codes to Users and verification codes to End Customers who verify their phone numbers on the Public Pages. In doing so it processes data that STAK processes as Controller under the Privacy Policy, not Customer Personal Data.
Apart from the providers above, STAK does not use text message, push notification, digital wallet, or address lookup, verification and mapping providers to Process Customer Personal Data.