Subencargados
Usamos las empresas siguientes para hacer funcionar OneBooks. Avisamos con al menos 30 días de antelación antes de añadir o sustituir cualquiera de ellas, para que puedas oponerte antes. Esta página se genera a partir del registro que el producto usa realmente, así que no puede quedarse atrás en silencio.
Neon
Hosts the PostgreSQL database in which all customer records are stored.
- Procesa en
- European Union (eu-central-1)
- En uso desde
- 2025-01-01
- Datos a los que acceden
-
- Every category of personal data in the service
- Account details, accounting records, contacts, attachments metadata
- Transferencias fuera del EEE
- None required for the primary store — data stays in the EU. Neon is additionally certified under the EU–US Data Privacy Framework.
Cloudflare
Runs the application, the APIs and the public sites, and provides the network and DDoS protection in front of them.
- Procesa en
- Global edge network; US-headquartered
- En uso desde
- 2025-01-01
- Datos a los que acceden
-
- Data in transit for every request
- IP addresses and request metadata
- Uploaded files held in object storage
- Transferencias fuera del EEE
- Standard Contractual Clauses, in Cloudflare’s customer Data Processing Addendum.
Stripe
Takes subscription payments and issues receipts.
- Procesa en
- United States and Ireland
- En uso desde
- 2025-01-01
- Datos a los que acceden
-
- Billing name and email
- Billing country and currency
- Payment and subscription status
- Transferencias fuera del EEE
- Certified under the EU–US Data Privacy Framework, its UK extension and the Swiss–US DPF. Card details never reach our systems.
Resend
Delivers transactional email: verification, password resets, and the invoices and quotes a customer chooses to send.
- Procesa en
- United States
- En uso desde
- 2025-01-01
- Datos a los que acceden
-
- Recipient email address
- Message subject and body, including any attached document
- Transferencias fuera del EEE
- ⟨TO BE COMPLETED BY THE CONTROLLER⟩ — confirm and file Resend’s DPA and transfer mechanism.
Google solo sitio web público
Measures aggregate usage of the public marketing website — and only if the visitor accepts analytics.
- Procesa en
- United States
- En uso desde
- 2025-01-01
- Datos a los que acceden
-
- Pseudonymous analytics identifier
- Pages viewed
- Approximate location from IP
- Transferencias fuera del EEE
- EU–US Data Privacy Framework. IP anonymisation enabled; advertising signals permanently denied under Consent Mode v2.
⟨TO BE COMPLETED BY THE CONTROLLER⟩ — AI model provider
Answers questions the AI assistant is asked, using the accounting data retrieved to answer them.
- Procesa en
- ⟨TO BE COMPLETED BY THE CONTROLLER⟩
- En uso desde
- 2026-09-01
- Datos a los que acceden
-
- The question the user types
- Accounting data retrieved to answer it
- Transferencias fuera del EEE
- ⟨TO BE COMPLETED BY THE CONTROLLER⟩ — name the provider actually enabled in AI_PROVIDER_ORDER, confirm its transfer mechanism, and record the Art. 35 DPIA. The assistant is available on every tier, including Free, so this is not an edge case.
Quién no está en esta lista
Los clientes preguntan por estos, así que aquí está el razonamiento en lugar del silencio.
- Shopify, Square, Clover, Lightspeed, Loyverse — A sub-processor is one WE engage to process on your behalf. You connect your own POS account and the data flows to us from it. They are a source of your data, not a processor we chose.
- ZATCA and other tax authorities — A recipient under your own legal obligation to file, not a processor acting on our instructions.
- Our logging and monitoring — Self-hosted on infrastructure we operate. No third party receives the data, so there is nothing to disclose or object to.