legal · gdpr
Sub-processor list
About this list
To run Kora, we rely on a small number of trusted providers (“sub-processors”) that process personal data on our behalf, under a data-processing agreement and only on our instructions. This page lists them and is referenced by our Privacy Policy. We keep it up to date and show the “last updated” date above.
Current sub-processors
| Provider | Role & data it receives | Hosting region | Transfer safeguard |
|---|---|---|---|
| Supabase | Database, authentication (email + password), private photo storage, and realtime chat. Receives account, profile, message, photo, and booking data. | EU (Ireland) | EU-hosted |
| Google Cloud | Hosts the Kora API and runs scheduled jobs. Processes app data in transit and at processing time. | EU (Belgium) | EU-hosted |
| Stripe | Payments, refunds, and merchant payout onboarding and identity verification. Receives payment metadata and merchant business, identity, and bank details (held by Stripe). | US / global | SCCs / EU–US DPF |
| Resend | Transactional and account email. Receives recipient email address and message content. | US | SCCs |
| Expo | Mobile push-notification delivery. Receives the device push token and the notification content (which can include a first name and a short message preview). | US | SCCs |
| Mapbox | Converts a merchant’s venue address into map coordinates. Receives merchant venue addresses. | US | SCCs |
| Amplitude | Product analytics, used only with consent. Receives aggregate usage events and a device/session identifier — no names, emails, or message content. | EU server zone | EU zone / SCCs |
| Sentry | Error and crash monitoring, configured to minimise personal data. Receives diagnostic and crash data. | US | SCCs |
| Vercel | Hosts the website, the merchant portal, and the admin area. Processes request and network data. | US | SCCs / EU–US DPF |
Authentication and credential storage are provided by Supabase; we never store your password. When you tap “directions” to a venue, your own maps app (Apple or Google Maps) opens with the venue location — that is your device, not a Kora transfer.
Changes to this list
If we add or replace a sub-processor, we update this page and, where the change is material, give notice in line with our Privacy Policy. To be told about changes, or for the transfer safeguards (such as the Standard Contractual Clauses) for any provider, write to privacy@koraexperiences.com.