Sub-processors
Kymiro works with a small number of carefully selected providers. Each of them is bound by a data processing agreement under Art. 28 GDPR and may only process data on our documented instructions.
Last updated: 21 August 2026
Lovable Cloud (Supabase infrastructure)
- What they process
- Hosting, database, file storage, authentication and server functions — venue, menu, session, request and account data.
- Processing location
- European Union
- Transfer safeguard
- Processing within the EU/EEA; no transfer safeguard needed.
Lovable AI Gateway (Google Gemini models)
- What they process
- Menu translation, reading menus from photos and generating product images. Only menu content is sent — never guest requests or account data.
- Processing location
- European Union with possible processing in the United States
- Transfer safeguard
- EU Standard Contractual Clauses plus supplementary measures.
Lovable Emails (Resend delivery)
- What they process
- Sending account emails: sign-up confirmation, password reset, staff invitations, welcome and support confirmations — recipient address, name and email content.
- Processing location
- European Union with possible processing in the United States
- Transfer safeguard
- EU Standard Contractual Clauses.
Stripe Payments Europe, Ltd.
- What they process
- Planned for venue subscription billing. Not active yet; when activated it processes venue billing data only, never guest payment data.
- Processing location
- Ireland / European Union
- Transfer safeguard
- Processing within the EU/EEA; EU Standard Contractual Clauses for any onward transfer.
Changes to this list
We announce new or replaced sub-processors at least 30 days in advance by email to the venue's registered address. Venues can object on reasonable data protection grounds within that period.