# GreetScribe Subprocessor List

**Version:** 2.1\
**Updated:** 2026-10-31\
**Operator:** Qevinto Oy

This list distinguishes processors used for customer data from Qevinto's own business services and customer-selected integrations. A software library is not, by its name alone, a recipient of data.

## 1. Core customer-data subprocessors

| Provider | Service and purpose | Data involved | Processing location |
|---|---|---|---|
| UpCloud Ltd | Application infrastructure and Managed Databases for PostgreSQL; storage and database backups | Guest conversations/session and contact records, customer content, accounts, relevant audit and operational records | Finland for the recorded core deployment; the two managed database services are in Helsinki (FI-HEL1). Provider support and onward processing remain subject to its contractual terms. |
| Scaleway SAS | Generative APIs: AI answers and, where enabled, embedding retrieval | Current question, system instructions, selected knowledge content; texts supplied for embeddings and authorised staff AI-authoring context | Standard Serverless inference: Paris, France. |
| Scaleway SAS | Secret Manager and Key Manager: credential protection | Integration/application secrets, key material and access metadata; not a conversation archive | Configured secret-management region: Amsterdam, Netherlands (nl-ams). |
| Scaleway SAS | Transactional Email: authentication and enabled service notifications | Recipient contact details, necessary message content and delivery metadata; guest-contact notifications only where that feature is enabled | Configured service region: Paris, France (fr-par); delivery to recipients' mail providers occurs outside that service boundary. |

UpCloud supplies the infrastructure; PostgreSQL is the database engine. Coolify, Redis/BullMQ and the self-hosted Better Auth library are software components, not additional third-party hosting/identity recipients merely because the service uses them.

Provider documents: [UpCloud data-processing terms](https://upcloud.com/terms-of-service/), [UpCloud security and privacy](https://upcloud.com/security-privacy/), [Scaleway Generative APIs privacy information](https://www.scaleway.com/en/docs/generative-apis/reference-content/data-privacy/). Provider terms do not replace Qevinto's obligations to the Customer.

## 2. Qevinto business and operational processing

Business enquiries and support correspondence are processed in Qevinto's business email systems. Accounting, legal advisers and operational services receive information needed for those purposes. They are not automatically subprocessors for the customer's entire guest dataset.

The software supports scrubbed error reporting and operator phone alerts. An installed monitoring client or alert adapter does not mean an external service is enabled. Operator notifications must exclude guest conversation text, guest contact details and credentials; operator telephone numbers and minimal technical event identifiers can be needed to deliver an alert. This list does not authorise sending guest datasets to a general monitoring or development service.

Qevinto must assess and disclose an additional provider before it receives Customer Personal Data, using the DPA change procedure where applicable. The independent development-copy rules in the Privacy Policy apply separately; they do not authorise undisclosed external AI tools.

## 3. Customer-controlled integrations

A Customer can authorise an available integration with its own booking/availability service, such as Bókun, Hostaway or Mews. Availability is subject to the configured adapter, account permissions and agreed service; naming a provider is not a promise that every provider or operation is enabled.

Those providers receive data under the customer's configuration and provider relationship. External booking and payment pages handle their own checkout and payment information. A customer-selected payment provider is separate from Qevinto's invoice billing.

## 4. Website technologies

The current website does not install Google Analytics, Meta Pixel, TikTok Pixel or LinkedIn Insight Tag. The actual website/widget storage is described in the [Privacy Policy](/privacy-policy). A customer's host website may use its own technologies.

## 5. Location and changes

An EEA service region does not prove that every provider's account, support and onward processing stays within the EEA. Qevinto must establish applicable safeguards before a restricted international transfer and can provide the relevant information on request.

Customer-data subprocessor additions/replacements follow the 30-day prior-notice and objection procedure in the [Data Protection Addendum](/data-protection-addendum). Existing contracts retain their agreed amendment rights.

Contact: [contact@qevinto.com](mailto:contact@qevinto.com). Previous published versions: [2.0, 2026-09-20](/legal/versions/2026-09-20/subprocessors.md) and [2026-05-17](/legal/versions/2026-05-17/subprocessors.md).