Sub-processors
Version 1.0 — published October 17, 2026
Version: 1.0 — published 2026-10-17.
Last changed: 2026-10-17. The Privacy Policy points at this page and commits to telling a holder before a sub-processor that handles their information is added or replaced, so this date is part of that commitment and moves whenever the list does.
Companion: the Data Processing Addendum (version 1.0) — how JoQuote processes personal data on a tenant's behalf, the security measures actually in place, and §8 on transfers. Both are published pages.
Third-party sub-processors
| Service | What it processes | Why |
| Stripe (Stripe, Inc. and affiliates) | Payment method data, KYC/identity data, transaction amounts, connected-account details that the tenant's own Stripe account processes — JoQuote does not initiate payouts and does not transfer funds on a tenant's behalf | Card payments, payouts, disputes, KYC/AML/sanctions for tenant connected accounts. Card numbers never reach JoQuote — payment fields are collected by Stripe's hosted checkout. |
| Google Analytics (Google Ireland Ltd / Google LLC) — only if an administrator switches it on | Page views, in-app actions and events, an approximate location derived from the network address, browser and device information, and the _ga cookies. No customer records, no job data, no names of end customers. | Product analytics: which features are used, where people get stuck. Loaded only after the visitor consents, and it is not connected to any advertising product. |
| Cloudflare R2 | Uploaded files (job photos, estimate photos, signatures, documents) | Object storage for tenant media, where the R2 backend is configured. |
| Intuit / QuickBooks Online — only if the tenant connects it | Invoice, payment, cost, tax and customer/contact data pushed by JoQuote; inbound payment data read back | Accounting synchronisation the tenant chooses to enable. |
| Xero — only if the tenant connects it | Same categories as QuickBooks | Accounting synchronisation the tenant chooses to enable. |
| An address-lookup service — only if the platform is configured to use one | Service addresses, as text, and only for the address being checked | Turning an address into coordinates for the map preview. This is not enabled in the current deployment, so today it receives nothing. |
| Email delivery provider (configured by the platform, or by the tenant with their own server) | Recipient address, message content (may include customer and job detail), unsubscribe links | Transactional and service email: booking confirmations, invoices, reminders, review requests. |
| Map tile provider (OpenStreetMap tiles) | The map viewport requested by the browser — not customer records | Rendering maps in the app. Requests come from the user's browser, so it sees an IP and a viewport, not tenant data. |
| Google (Maps / Places, review links) | Address or place query text where address autocomplete is used; nothing where it is not | Address entry assistance and the review URLs a tenant configures. |
| Hetzner (hosting / infrastructure) | The application servers and, where the database is self-hosted, the PostgreSQL data and uploaded files | Running the service. Confirmed by the owner 2026-09-14: hosted in GERMANY. For Australia this engages APP 8 — disclosing personal information to an overseas recipient makes the discloser accountable for that recipient's acts unless an exception applies. |
| Supabase (managed PostgreSQL), hosted in Germany | The tenant database: customers, jobs, estimates, invoices, payments, team members, settings, and the metadata for uploaded files | The primary datastore for the service. JoQuote's application reaches it over an encrypted connection. |
What governs this list, and where the data goes
The Data Processing Addendum — /data-processing-addendum (version 1.0) — is the document that binds us to a tenant for everything on this page: it lists the obligations we accept, the security measures actually in place (Schedule A), and the notice we owe before this list changes.
And the transfer position belongs here, because this is the page that names the destinations. Customer data is stored in Germany and reached from Hong Kong; if analytics is switched on, Google processes usage data in the United States. ⛔ No Chapter V mechanism is in place, and the addendum says so in its §8 rather than in a file a reader cannot open. A tenant who needs that cover should not send EU or UK personal data until a later version names an instrument.
Breach notification, data-subject requests and the cookie control are not described here: they are in the Privacy Policy and the addendum, and repeating them on a page about sub-processors would give two versions of one promise.