Subprocessors
HapHood runs on a small set of carefully chosen service providers. This page lists each one, what it does for us, and what data it processes — so our Privacy Policy never has to say "trusted third parties" and leave you guessing. Providers that handle personal information on our behalf do so only on our instructions, under contracts requiring them to protect it to at least the standard described in our Privacy Policy. When this list changes, we update this page.
Core infrastructure
Hostinger
Hosts our servers and database in Europe. All data HapHood stores — accounts, deals, reservations, images — lives on this infrastructure, on encrypted volumes.
Cloudflare
Content delivery, TLS, and security in front of everything at haphood.com, plus hosting for the website, web app, and app downloads. Processes IP addresses and request logs for all traffic; where we maintain backups, they are encrypted before upload and stored in EU-jurisdiction object storage here.
Logto
Our authentication provider. Holds your email, password, name, and avatar; runs the hosted sign-in and password-reset pages. HapHood never sees your password.
Inside the product
Stripe
Payments for shops: card storage, monthly invoicing, and fraud prevention. Card details are entered directly with Stripe and never touch our servers. Processes the shop owner's name, email, and billing usage. Operates globally, including in the US.
PostHog (EU)
Product analytics, hosted in the EU. In-app and website analytics (including consent-gated session replay) runs only after you consent, under a random identifier not linked to your name or email. Our servers also send it service events (like "a deal was redeemed") tied to your account ID — pseudonymous, not your name or email — to measure whether HapHood works.
Resend
Delivers our transactional email — team invitations, join-request updates, feedback copies, and sign-in emails. Processes recipient addresses and message content. US-based.
Google Firebase Cloud Messaging & Apple Push Notification service
Deliver push notifications to the mobile apps (Google's FCM on Android; on iOS, delivery is completed by Apple's push notification service). Process device push tokens and notification content (deal and shop names). Operate globally.
CARTO & OpenStreetMap Foundation
Serve the map tiles in the app (CARTO primarily, OpenStreetMap as fallback). Your device fetches tiles directly, so these services see your IP address and the map area you're viewing — but never your account.
Photon (Komoot) & postcodes.io
Turn coordinates into readable place names and help shops enter addresses. Process the coordinates or address text of the lookup. Photon is operated from Germany; postcodes.io is a UK service built on Ordnance Survey and ONS open data.
Google Maps Platform
Used on our servers to look up public business information (place details and photos) when shops join HapHood and to verify listings. Processes place search queries — not customer data.
On the website
Google Fonts
The haphood.com website loads its typeface from Google Fonts, which means your browser sends your IP address to Google when the page loads. The web app doesn't — it ships its fonts itself.
Questions
If you'd like more detail on any provider — or on the safeguards for transfers outside the UK — email [email protected].