Sub-processors
Version 1.1.0In effect from Oct 24, 2026
1. What this list is for
A sub-processor is a provider that the Provider (Berényi Levente egyéni vállalkozó, the operator of Bitecard) engages and that may, in doing so, have access to personal data processed on behalf of the Customer (the restaurant). This list forms part of the Data processing agreement.
2. The list
Sub-processors that handle data entered by the restaurant
"SCCs" means the standard data protection clauses adopted by the European Commission in Decision 2021/914.
| Provider | Service | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Vercel (Vercel Inc., USA) | application hosting, logs, image storage (Vercel Blob) | all data passing through the application; uploaded images | EU: application and image store in Frankfurt (fra1); logs and backups in the USA | EU-US Data Privacy Framework; also SCCs (2021/914, Modules 2 and 3) in Vercel's data processing agreement |
| Prisma (Prisma Data, Inc., USA) | database (Prisma Postgres) | Account, restaurant and menu data | EU: Frankfurt (eu-central-1) | EU-US Data Privacy Framework; SCCs towards its own sub-processors |
| Resend (Plus Five Five, Inc., USA) | email delivery (invitations) | the recipient's email address, the message content | sending from the EU (Ireland); storage mainly in the USA | SCCs (2021/914, Module 2) and the EU-US Data Privacy Framework |
| PostHog (PostHog Inc., USA) | product analytics with consent, anonymous menu-page views | pseudonymous user identifier, masked session recordings, view counts, anonymous business events | EU: Frankfurt (PostHog Cloud EU) | data stays in the EU; for any US access, SCCs (2021/914, Module 2) |
| Sentry (Functional Software, Inc., USA) | error monitoring | cleaned error reports | EU: Germany | data stays in the EU; for any US access, the EU-US Data Privacy Framework, with SCCs as a fallback |
Other providers that have no access to data entered by the restaurant
These take part in the Provider's own processing (see the Privacy policy):
| Provider | Service | Location | Transfer safeguard |
|---|---|---|---|
| Stripe (Stripe Payments Europe, Limited, Ireland) | subscription fees, card payment | EU (Ireland); Stripe, Inc. and its affiliates also in the USA | EU-US Data Privacy Framework, with SCCs as a fallback |
| Számlázz.hu (KBOSS.hu Kft., Hungary) | issuing electronic invoices | EU: Hungary, data stored in Frankfurt | no transfer outside the EEA |
3. Changes
The Provider notifies the Account owner by email at least 30 days before engaging a new sub-processor or replacing an existing one, and updates this page. The Customer may object during that time at support@bitecard.app. If the parties cannot agree, the Customer may end the contract before the change takes effect.