Last updated
October 1, 2026
Subprocessors
Salonera relies on a small set of trusted third parties to deliver the service. The list below states what each one is used for and where the data is stored. The list is reviewed whenever a service is added or replaced.
Cloudflare Workers, Web Analytics and Turnstile
Purpose: website hosting and edge functions, aggregate Web Analytics when enabled, plus bot detection and abuse prevention on the sign-in and booking flows (a CAPTCHA replacement).
Rate limiting: short-lived pseudonymous counters (a hash of the IP address, email address or user ID) are kept in Cloudflare Durable Objects and deleted within an hour.
Region: global edge network. Cloudflare Inc. is US-based. Transfers operate under Standard Contractual Clauses (SCCs) with supplementary safeguards.
Data processing agreement: yes.
Supabase
Purpose: database (Postgres), authentication, and file storage for images and documents.
Region: EU (eu-central-1, Germany). Data is stored in the EU/EEA; the DPA covers any access by personnel outside the EEA.
Data processing agreement: yes.
Sentry
Purpose: error reporting and performance monitoring. Sentry Session Replay runs only on errors, with text masked and media blocked.
Region: EU (de.sentry.io, Germany). Data is stored in the EU/EEA; the DPA covers any access by personnel outside the EEA.
Data processing agreement: yes.
PostHog
Purpose: product analytics, only after consent in the cookie banner.
Region: EU (eu.i.posthog.com).
Data processing agreement: yes.
Resend
Purpose: transactional email (booking confirmations, OTP sign-in, invitations).
Region: EU (eu-west-1, Ireland). Data is stored in the EU/EEA; the DPA covers any access by personnel outside the EEA.
Data processing agreement: yes.
Changes
We update this list whenever a provider changes or a region is moved. The date at the top reflects the latest revision.