Sub-processors
The providers that process personal data for Airplate when a venue uses the service, what each receives, where, and under which transfer mechanism. They are authorised under our Data Processing Agreement; Airplate announces a new one on this page and by e-mail to each venue at least thirty days before it starts. Last updated 2026-10-19.
For venue data
| Sub-processor | Purpose | Personal data | Location | Transfer mechanism |
|---|---|---|---|---|
| DigitalOcean, LLC (USA) | Purpose: Hosts the Airplate application, its database and its file storage. | Personal data: Everything in a venue's account: users, clients' names, e-mail addresses, phone numbers, companies, addresses and VAT numbers, event details, proposals, contracts, signatures and uploaded files. | Location: Frankfurt, Germany (EU). | Transfer mechanism: EU–US Data Privacy Framework (active participant) and the European Commission's Standard Contractual Clauses. |
| Cloudflare, Inc. (USA) | Purpose: Network and security layer in front of airplate.ai and its API. | Personal data: Every request: IP address, browser, page address. | Location: Cloudflare's network worldwide, so this may be outside the EU. | Transfer mechanism: EU–US Data Privacy Framework (active participant) and the European Commission's Standard Contractual Clauses. |
| Hetzner Online GmbH (Germany) | Purpose: Hosts Airplate's electronic-signature service (open-source Documenso software, operated by Airplate). | Personal data: Contracts sent for signature, signers' names and e-mail addresses, signatures and the signing audit trail. | Location: Helsinki, Finland (EU). | Transfer mechanism: None: within the EU. |
| Mailgun Technologies, Inc. (USA, part of Sinch) | Purpose: Sends the e-mails Airplate sends for the venue and returns their delivery reports. | Personal data: Names, e-mail addresses, the content of those e-mails and their attachments. | Location: Mailgun's EU region (Germany and Belgium) for message content; account records are global. | Transfer mechanism: EU–US Data Privacy Framework (active participant) and the European Commission's Standard Contractual Clauses. |
| Stripe Payments Europe, Limited (an Irish company) | Purpose: Client deposits paid by card on the venue's own Stripe account; Airplate's subscription billing. | Personal data: The client's e-mail address and the deposit amount; the venue's billing and payout details, collected on Stripe's own pages. Card details are entered only on Stripe's pages. | Location: EEA; Stripe transfers data to Stripe, LLC in the USA. | Transfer mechanism: EU–US Data Privacy Framework (active participant) and the European Commission's Standard Contractual Clauses. |
| Mistral AI (France) | Purpose: Language model behind the in-app assistant, the support chat, e-mail template translation and the Airplate bot's reading of messages and voice notes. | Personal data: Messages typed in those chats (e-mail addresses, phone numbers, IBANs and card numbers are replaced with placeholders first), template text, the venue's account and catalogue details, booking details the assistant looks up (client names and company, event type, date, guests, price, status), and voice notes sent to the bot, to transcribe them. | Location: EU (Mistral's EU endpoint). | Transfer mechanism: None: within the EU. |
| Pinecone Systems, Inc. (USA) | Purpose: Searches Airplate's own product documentation to ground chat answers. | Personal data: The text of each chat message (with the same placeholders), to run that search. Only Airplate's product documentation is kept there; no personal data. | Location: United States. | Transfer mechanism: The European Commission's Standard Contractual Clauses. |
| European Commission (VIES) | Purpose: Checks a company VAT number entered on a request form. | Personal data: The VAT number. | Location: EU. | Transfer mechanism: None: within the EU. |
Optional, enabled by the venue
Telegram (Telegram Messenger Inc.): optional, enabled by the venue. When a venue connects the Airplate bot, Telegram receives the booking summaries sent to the venue's linked chats (reference, event type, date and times, room, guests, totals, status) and the messages and voice notes the venue's staff send to the bot. Airplate sends no client e-mail address, phone number or postal address to Telegram.
Location: outside the EU. No vendor DPA: Telegram does not offer one.
Integrations a venue connects to its own account
Apaleo (in certification) and HubSpot (available on request) receive the booking details the integration needs in the venue's own account. Each processes that data for the venue under the venue's own agreement with it, so they are not Airplate sub-processors.
Airplate's own tools
Used by Airplate for its own website and team, not for venues' client data. Described in the privacy policy.
| Sub-processor | Purpose | Personal data | Location | Transfer mechanism |
|---|---|---|---|---|
| Tally BV (Belgium) | Purpose: The "Book a Demo" form on the Airplate website. | Personal data: Name, e-mail address, company name and website, comments, privacy consent. | Location: EU (Google Cloud, Belgium); submission e-mails through SendGrid (Twilio, USA). | Transfer mechanism: SendGrid: Twilio's Data Protection Addendum (EU–US Data Privacy Framework, then Standard Contractual Clauses). |
| Calendly LLC (USA) | Purpose: Booking a call with the Airplate team. | Personal data: Name, e-mail address, the chosen time and the answers given on the booking page. | Location: United States. | Transfer mechanism: EU–US Data Privacy Framework; Standard Contractual Clauses (Module 2) if it ceases to apply. |
| Slack Technologies Limited (an Irish company) | Purpose: Internal alerts to the Airplate team: a new venue to review, pilot and waitlist sign-ups, support tickets. | Personal data: Venue name and owner e-mail; sign-up names, e-mails, phones, property, city, country; ticket e-mail, subject and message. | Location: United States. | Transfer mechanism: EU–US Data Privacy Framework (active participant) and the European Commission's Standard Contractual Clauses. |