Infrastructure and Platform
| Provider | Role | Data Categories | Region | Transfer Guarantee |
|---|---|---|---|---|
| Google Firebase (Google LLC) |
Auth, Firestore database, Cloud Functions, Hosting | Guest booking data, provider account data, auth credentials, platform logs | Cloud Functions, Hosting and Authentication: EU (europe-west1, Belgium). The Firestore database is currently located in a US multi-region (nam5); migration to an EU multi-region location (with europe-west1 among its EU read-write regions) is in progress. Some support operations may touch global infrastructure | SCC (2021/914/EU) + EU–US Data Privacy Framework |
| Google Calendar API (Google LLC) |
Optional calendar sync: (1) business-level — confirmed bookings written to the owner's Google Calendar if enabled; (2) staff-level — staff member's personal Google Calendar free/busy status read for availability blocking, and optionally bookings written to the staff member's personal calendar if the staff member individually enables this | Confirmed booking time and description details; staff calendar free/busy status | Google Workspace / global infrastructure | SCC (2021/914/EU) + EU–US Data Privacy Framework |
| Microsoft Ireland Operations Ltd. (Microsoft Graph / Outlook Calendar — parent: Microsoft Corporation, USA) |
Optional staff-level calendar sync with a Microsoft 365 / Outlook account: the staff member's personal Outlook calendar free/busy status is read for availability blocking, and confirmed bookings may optionally be written to the staff member's personal Outlook calendar if the staff member individually authorises this (OAuth scope). Activated only with the staff member's explicit connection. | Time and description of confirmed bookings (push); staff calendar free/busy state (pull) | Microsoft global infrastructure; EU data localisation per Microsoft EU Data Boundary, certain support operations may involve global infrastructure | SCC (2021/914/EU) + EU–US Data Privacy Framework |
| Firebase Cloud Messaging (FCM) (Google LLC — part of Firebase platform services) |
Push notification delivery to Bokko dashboard and booking web app users (booking status changes, operational notifications). The push token (FCM registration token) is a pseudonymous device-linked identifier; Bokko acts as intermediary between user and Google. | FCM registration token (pseudonymous device identifier); push notification payload (booking ID, event type, localised text — no guest PII) | EU (per Firebase regional configuration); certain Google support operations may involve global infrastructure | SCC (2021/914/EU) + EU–US Data Privacy Framework |
| Google Maps Platform (Places API — Google LLC) |
Address autocomplete (optional; in profile and billing fields) | Search characters typed by the user; not linked to booking profiles | Google global infrastructure | SCC (2021/914/EU) + EU–US Data Privacy Framework |
| Sentry, Inc. | Error monitoring and technical diagnostics. Bokko's configuration uses data minimization (redacting emails, phones, tokens). | Error reports, stack traces, client metadata, technical identifiers (subject to redaction) | May involve processing outside the EEA depending on provider infrastructure | SCC and other compliance guarantees; where applicable, EU–US Data Privacy Framework |
Communication
| Provider | Role | Data Categories | Region | Transfer Guarantee |
|---|---|---|---|---|
| Spoje.net, s.r.o. (BulkGate) | Optional SMS reminders before confirmed appointments | Normalized phone number, message content, delivery metadata | EU (Czech Republic) for platform storage; delivery chain may involve third countries | DPA; delivery chain may involve third countries (carriers, aggregators) |
| Mailjet SAS (Sinch Group subsidiary) |
Email notifications (requests, confirmations, status, reminders) | Email address, message content, delivery metadata | Primarily EU (France) | Primarily EEA processing; SCCs applied where necessary |
Transfer Guarantees
Data transfers outside the EEA are based on the following mechanisms:
- Standard Contractual Clauses (SCC): Clauses adopted by the European Commission (2021/914/EU) relied upon by relevant providers.
- EU–US Data Privacy Framework (DPF): Where the provider is certified under the framework adopted on July 10, 2023.