Sub-processors
Last updated: 2026-08-02
BakeOnyx acts as a data processor for the personal data a bakery collects — its staff, its store and wholesale customers, and its business contacts. The bakery is the data controller. To provide the Service we engage a limited set of trusted third parties (“sub-processors”) that may process personal data on our behalf, in line with our Data Processing Addendum and GDPR Article 28.
Not every sub-processor applies to every bakery — those marked enabled by feature only process data when you turn on the related feature or integration. We use only what is necessary to run the Service and do not sell personal data or use it to train our own AI models.
Current sub-processors
| Service | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Hetzner | Cloud hosting and infrastructure (application + database) | EU (Germany) | Within EEA — no transfer |
| Anthropic (Claude) | Primary AI provider — powers AI features (assistant, insights, drafting, forecasting) | United States | SCCs / DPF |
| OpenAIenabled by feature | Fallback AI provider — used if the primary provider is unavailable | United States | SCCs / DPF |
| Stripe | Payment processing (subscriptions and, at the bakery’s option, storefront payments) | United States | SCCs / DPF |
| Squareenabled by feature | Alternative payment processing (when enabled by the bakery) | United States | SCCs / DPF |
| Resend | Transactional and marketing email delivery | United States | SCCs |
| Sentry | Error tracking and performance monitoring | United States | SCCs |
| AWS S3 | File and image storage | United States | SCCs / DPF |
| Meta Platforms (WhatsApp, Messenger, Instagram)enabled by feature | Customer messaging and social media integrations | United States | SCCs / DPF |
| Twilioenabled by feature | SMS messaging | United States | SCCs |
| Google (Calendar)enabled by feature | Calendar synchronization | United States | SCCs / DPF |
| Intuit (QuickBooks)enabled by feature | Accounting integration | United States | SCCs |
| Xeroenabled by feature | Accounting integration | New Zealand / Global | SCCs |
International data transfers
Where a sub-processor processes personal data outside the European Economic Area (EEA), that transfer is safeguarded by the mechanism shown above:
- SCCs— the European Commission’s Standard Contractual Clauses, incorporated into our agreement with the sub-processor, with supplementary measures as appropriate.
- SCCs / DPF — SCCs and, where the sub-processor is certified, the EU–US Data Privacy Framework.
- Within EEA — no transfer — data stays inside the EEA, so no transfer mechanism is required.
Changes and how to object
We may add or replace sub-processors as the Service evolves. When we do, we will update this page and the “Last updated” date. Bakeries can subscribe to advance notice of new sub-processors by emailing privacy@bakeonyx.ai. If you have a reasonable, data-protection-based objection to a new sub-processor, contact us at the same address and we will work with you in good faith; where we cannot resolve the objection, you may terminate the affected Service as your remedy, as set out in the DPA.