Subprocessors

Controller: the business client (salon). Processor: DOIT-BI Sp. z o.o. (Terminka). Below is the list of external service providers who help us deliver the Service and may process personal data on our behalf (Art. 28 GDPR).

November 17, 2025
Active in production

  • Google LLC — product and traffic analytics; services: Google Analytics / (optionally Firebase Analytics).
    Data categories: device/user identifiers, app/WEB events, device metadata, anonymized IP address.
    Processing/transfer location: EU/EEA and USA.
    Legal basis for transfer: SCC (2021/914) + Google DPA.
    Status: active.

  • Mixpanel, Inc. — product analytics (events, funnels, retention); service: Mixpanel.
    Data categories: technical identifiers, app events, timestamps.
    Location/transfer: EU/EEA and USA.
    Legal basis: SCC + Mixpanel DPA.
    Status: active.

Optional / disabled by default

  • Apple Inc. — authentication; service: Sign in with Apple.
    Data categories: Apple user identifier, masked email (relay).
    Location/transfer: EU/EEA and USA.
    Legal basis: Apple mechanisms / SCC.
    Status: optional (disabled).

  • Meta Platforms, Inc. — authentication; service: Facebook Login.
    Data categories: profile ID, email (if shared).
    Location/transfer: EU/EEA and USA.
    Legal basis: Meta mechanisms / SCC.
    Status: optional (disabled).

  • Google LLC — user authentication; service: Google Sign-In (OAuth 2.0).
    Data categories: email address, first and last name (if available), profile ID for login.
    Location/transfer: EU/EEA and USA.
    Legal basis: SCC + Google DPA.
    Status: active.

Notes and safeguards
  • We limit the scope of data to the minimum necessary to achieve the purpose (privacy by design).
  • We have data processing agreements (DPAs) with all subprocessors and apply Standard Contractual Clauses (SCC) in case of transfers outside the EEA.
  • Analytics is used to improve the performance of the application and does not include private visit notes.
  • Authentication is used solely for logging in and linking accounts; we do not use this data for marketing purposes without a legal basis.
Changes to the list

If we add a new subprocessor or change the purpose of processing, we will update this page before the changes take effect, in accordance with our Privacy Policy. To receive notifications about such updates, please contact us at the address provided in the Privacy Policy.