To provide reliable, highly available scheduling services, Stylacal contracts with third-party service providers ("Sub-processors"). Each vendor undergoes rigorous security and privacy evaluation prior to onboarding.
Approved Infrastructure Sub-processors
| Sub-processor | Service Provided | Data Processed | Location |
|---|---|---|---|
| Railway Corp. | Container Hosting & Application Runtime | Encrypted web traffic, API workloads, system logs | United States (US-East) |
| Supabase Inc. / AWS | Managed PostgreSQL Relational Database | Encrypted customer records, appointments, schema | United States (US-East) |
| Cloudflare, Inc. | Edge CDN, SSL Termination & DDoS Protection | IP addresses, HTTP header metadata, DNS records | Global Edge Network |
| Clerk, Inc. | Identity & Workspace Owner Authentication | Workspace owner emails, MFA tokens, session logs | United States |
| Stripe, Inc. | Platform Subscription Billing & Connect | Billing records, Stripe Connect account IDs, payment metadata | United States |
| Resend Inc. / SendGrid | Transactional Email Delivery | Recipient emails, booking confirmation notices | United States |
| Twilio Inc. / Meta | WhatsApp Business API Messaging | Recipient phone numbers, reminder templates | Global / United States |
Sub-processor Change Notification Protocol
Stylacal provides Workspace Owners with at least 30 calendar days advance notice before engaging any new sub-processor that processes personal data. Notifications are delivered via email to the registered Workspace Owner address and posted to this directory.
If you reasonably object to the engagement of a new sub-processor on grounds relating to data protection, you may notify us in writing within 14 calendar days of receiving the notice. In such cases, Stylacal will work in good faith to discuss your concerns or assist you in exporting your data.