Draft — not yet reviewed by a lawyer.
What this page says about data, retention and subprocessors is taken from how the software actually behaves and is accurate. The clauses that create legal obligations are marked as outstanding and have not been drafted.
Subprocessors
Last updated 15 September 2026
The other companies involved in running Lazavee, and what each one receives. This list forms part of the privacy notice; a change to it is a change to that notice.
It is deliberately short, and short for a reason: every entry is another organisation holding a business's customers' details, and the cheapest way to protect data is not to send it anywhere.
In use today
| Provider | What for | What it receives | Where |
|---|---|---|---|
| Hostinger | Hosting, database, backups and email delivery | Everything, at rest: every booking, customer record and note. Its mail service also carries each confirmation, reminder and cancellation we send, with the recipient's address and the calendar invite attached. This is the subprocessor with the most personal data passing through it. | Singapore |
| Cloudflare | Domain names, and the network in front of the site | Every request passes through it, so anything typed into a booking form travels through Cloudflare on its way to us: names, email addresses and phone numbers. It holds copies of public files such as the widget script, not the database. | Global network |
| Sentry | Error monitoring | Diagnostic reports when something breaks. Names, email addresses, phone numbers, notes and business-defined field values are removed before a report leaves our servers; what remains is which business and which code path. | European Union |
| PayMongo | Taking Lazavee subscription payments from Philippine businesses | The paying business's own details and what it is paying for. Card details are entered on the provider's own page and never reach this application, by design. It receives nothing about that business's customers or their bookings. | Philippines |
| PayPal | The same, for businesses outside the Philippines | As above. | Global |
| Have I Been Pwned | Refusing passwords that have appeared in a known breach | The first five characters of a one-way hash of the password being set, and nothing else. Not the password, not the rest of the hash, not who is setting it. | Global |
Not yet applicable
| Role | Would receive | Status |
|---|---|---|
| Taking payment for an appointment | Whatever a gateway needs to take a deposit from your customer. | Not built. The payment providers above are how a business pays us; no money moves between a business and its own customers through Lazavee. |
| Object storage | Images a business uploads. | Not built. Nothing in the product accepts an upload. |
| SMS delivery | Phone number and message text. | Not built. Notifications are email only. |
Outstanding: how long backups are kept and where, which is a question for our hosting plan rather than the code; and how businesses are notified before a new subprocessor is added, and how long they get to object. The latter are commitments rather than facts about the code, and are for whoever signs the contracts.