Infrastructure and Platform
| Provider | Role | Data Categories | Region | Transfer Guarantee |
|---|---|---|---|---|
| Google Firebase (Google LLC) |
Auth, Firestore database, Cloud Functions, Hosting | Guest booking data, provider account data, auth credentials, platform logs | Primarily EU (europe-west1, Belgium); some support operations may touch global infrastructure | SCC (2021/914/EU) + EU–US Data Privacy Framework |
| Google Calendar API (Google LLC) |
Optional calendar sync: (1) business-level — confirmed bookings written to the owner's Google Calendar if enabled; (2) staff-level — staff member's personal Google Calendar free/busy status read for availability blocking, and optionally bookings written to the staff member's personal calendar if the staff member individually enables this | Confirmed booking time and description details; staff calendar free/busy status | Google Workspace / global infrastructure | SCC (2021/914/EU) + EU–US Data Privacy Framework |
| Google Maps Platform (Places API — Google LLC) |
Address autocomplete (optional; in profile and billing fields) | Search characters typed by the user; not linked to booking profiles | Google global infrastructure | SCC (2021/914/EU) + EU–US Data Privacy Framework |
| Sentry, Inc. | Error monitoring and technical diagnostics. Bokko's configuration uses data minimization (redacting emails, phones, tokens). | Error reports, stack traces, client metadata, technical identifiers (subject to redaction) | May involve processing outside the EEA depending on provider infrastructure | SCC and other compliance guarantees; where applicable, EU–US Data Privacy Framework |
Communication
| Provider | Role | Data Categories | Region | Transfer Guarantee |
|---|---|---|---|---|
| Spoje.net, s.r.o. (BulkGate) | Optional SMS reminders before confirmed appointments | Normalized phone number, message content, delivery metadata | EU (Czech Republic) for platform storage; delivery chain may involve third countries | DPA; delivery chain may involve third countries (carriers, aggregators) |
| Mailjet SAS (Sinch Group subsidiary) |
Email notifications (requests, confirmations, status, reminders) | Email address, message content, delivery metadata | Primarily EU (France) | Primarily EEA processing; SCCs applied where necessary |
Transfer Guarantees
Data transfers outside the EEA are based on the following mechanisms:
- Standard Contractual Clauses (SCC): Clauses adopted by the European Commission (2021/914/EU) relied upon by relevant providers.
- EU–US Data Privacy Framework (DPF): Where the provider is certified under the framework adopted on July 10, 2023.