In plain words
- These are the companies that host, deliver or secure Walk-In Waitlist for us.
- Each gets only what it needs for its job, under a contract that limits its use to our instructions.
- Everything is processed in the United States, with Cloudflare and Vercel answering from servers near you.
- We announce a new provider here and by email to shop owners 30 days before it starts.
Current subprocessors
| Provider | What it does for us | What it receives | Where |
|---|---|---|---|
| Supabase, Inc. | Database, staff sign-in, file storage for logos, realtime queue updates and the server functions that send texts and emails | All service data: shops, teams, staff emails, customer first names and mobile numbers, visits, consent records, texts and replies | United States (AWS us-east-1, Northern Virginia) |
| Vercel, Inc. | Hosts the website, the join and status pages and the staff pages | Page requests: IP address, browser details and the pages visited; data passing between your browser and our database | United States, with a global edge network |
| Telnyx LLC | Sends and receives text messages, provides each shop's phone number, and registers shops with The Campaign Registry and the carriers | Customers' mobile numbers, text bodies and replies; for registration, the shop's business details (legal name, EIN, owner contact, address, website) | United States |
| Stripe, Inc. | Subscriptions, card payments, invoices, receipts, taxes and the billing portal | Owner's email, business name, billing address and card details (collected by Stripe directly), seats and extra texts used | United States |
| Resend (Plus Five Five, Inc.) | Delivers sign-in codes and owner emails | Staff email addresses and the email content | United States |
| Cloudflare, Inc. | Turnstile, the check that a person and not a bot is joining a line | On the join page: IP address and browser signals needed for the check | Global network, company in the United States |
| Google LLC (Google Analytics) | Measures visits to the marketing, legal and guide pages, only after a visitor accepts analytics cookies | Pages visited, a random browser id, device and approximate location data; never the join, status, staff or admin pages | United States |
| Expo (650 Industries, Inc.) | Builds the iOS and Android staff apps and submits them to the app stores | The app's code and build settings; no personal data of customers or staff | United States |
Carriers and The Campaign Registry. To deliver texts and register each shop for business texting, Telnyx passes the necessary information to The Campaign Registry and to mobile carriers. They act under the rules of the US texting industry and are not under contract with us.
App stores. Apple and Google distribute the staff app. They do not receive data from Walk-In Waitlist about customers or staff; their own terms and privacy policies apply to the download.
What we require from each provider
- A written contract that limits use of the data to providing their service to us, keeps it confidential and requires security measures.
- Notice to us of a security incident affecting our data.
- Deletion or return of the data when the service ends, subject to their legal duties.
Changes to this list
We post any new subprocessor on this page and email shop owners at least 30 days before it starts processing customer data, unless an emergency requires a faster change. Shops can object as described in the Data Processing Addendum.
Contact
Kallos Labs LLC, our support email (coming soon). See also the Privacy Policy.
Change log
- Version 1.0, October 1, 2026: First version.
Questions about this page? Write to our support email (coming soon).