Sub-processors | Westorably

Core infrastructure

Sub-processor	What it does	Data processed	Location
Vercel Inc.	Application hosting, edge delivery and serverless execution	All application traffic, in transit	United States
Railway Corp.	Managed PostgreSQL database and Redis cache	All Customer Data at rest	United States
Amazon Web Services, Inc.	Object storage for documents, identity scans and unit photographs	Uploaded files	United States

Payments

Sub-processor	What it does	Data processed	Location
Stripe, Inc.	Card and bank payment processing, subscription billing, payouts, identity verification	Tenant name, email, billing address, payment method, transaction history. Full card numbers are held by Stripe, never by Westorably.	United States, Ireland

Communications

Sub-processor	What it does	Data processed	Location
Twilio SendGrid	Transactional email: reminders, receipts, lease copies, account notices	Recipient name, email address, message content	United States
Twilio Inc.	SMS reminders, where the SMS add-on is enabled	Recipient phone number, message content	United States
Google LLC (Workspace)	Business email and documents used for support and sales correspondence	Correspondence you send us	United States, EU

Monitoring and support

Sub-processor	What it does	Data processed	Location
Functional Software, Inc. (Sentry)	Error and performance monitoring	Error diagnostics, user identifier, IP address. Personal data is scrubbed before transmission where technically possible.	United States

Website measurement

These run on this marketing website only. They are not part of the Westorably application and never touch tenant records. They load only after a visitor accepts cookies.

Sub-processor	What it does	Data processed	Location
Google LLC (Google Analytics 4)	Aggregate traffic measurement for westorably.com	Anonymised IP address, device and browser type, pages viewed, referring site, and clicks on the booking and email links. Advertising features, Google Signals and remarketing are disabled.	United States, EU
Google LLC (Google Tag Manager)	Loads the measurement tags listed here. It is a container, not a measurement tool of its own.	IP address and user agent, as part of requesting the container file. Tags inside it do not run until a visitor accepts cookies.	United States, EU
Contentsquare SA	Heatmaps and session replay for westorably.com, used to find where visitors get stuck	Anonymised IP address, device and browser type, mouse movement, scrolling and clicks. Text entered into form fields is masked and not recorded.	European Union

Enabled only by you

These process data only if you switch on the corresponding integration. They act under their own agreements with you as well as ours.

Sub-processor	What it does	Data processed	Location
Noke / Janus / PTI / OpenTech	Smart lock and gate access control, where you install compatible hardware	Unit identifier, tenant identifier, access credentials, entry and exit events	United States

How changes are notified

We publish the change on this page and update the “last updated” date.
We email the account owner at least 30 days before the new sub-processor begins processing.
You may object on reasonable data protection grounds within that window by emailing legal@westorably.com. The objection process is set out in section 6 of the DPA.
Emergency replacement of a sub-processor for security or continuity reasons may happen faster; we will notify you as soon as possible and your objection rights are unaffected.