Sub-processors (Annex 2 to the Terms)
Version: 2026-12-07 (new: Microsoft, Windows Quick Assist for remote help, from 7 December 2026; see Changes). We notify subscribers by e-mail of a new provider, or of an existing provider used for a new purpose, at least 8 days (30 days until version 2026-12-10 takes effect) before its actual use; you may object (Data Processing Agreement clause 4.4). Safeguards for transfers to the USA, recipient by recipient: Data Processing Agreement clause 6.
| Provider | Purpose | Location | Data | When |
|---|---|---|---|---|
| Supabase Inc. | database, sign-in, file storage (photos, the workshop's logo, the full text and screenshots of problem reports) | EU, Frankfurt (eu-central-1, AWS); from the USA only operational access (SCC) | all program data | always |
| Cloudflare, Inc. | serving the program and website, protection against overload | global network, including the EU (DPF, failing certification SCC) | transit traffic and IP address only, no data stored | always |
| Sendinblue SAS (Brevo) | system e-mails: invitation, password, quote notice, contract and terms change notice | EU, France | e-mail address, name, message text | when an e-mail is sent |
| KBOSS.hu Kft. (Számlázz.hu) | issuing invoices with the workshop's own account | Hungary | buyer and line data | only if the workshop switches it on |
| Anthropic PBC | AI functions | USA (SCC, with a transfer impact assessment) | only the text or photo of the request (for example a registration certificate photo when adding a vehicle); for AI data import only column names and artificial sample data; not used for training | only if the workshop switches it on |
| GitHub, Inc. (Microsoft) | storing the daily backup, for 7 days | USA (DPF, failing certification SCC) | the whole database, encrypted only; the key stays with the Provider | daily, while Supabase's own backup is not switched on |
| GitHub, Inc. (Microsoft) | problem reports and ideas (the program's Report a problem item), the developer's answers | USA (DPF, failing certification SCC) | only an automatically redacted copy: title and text of the report with "[kitakarva]" instead of phone numbers, e-mail addresses, registration numbers, VINs and names, and only the technical details needed to reproduce the problem (page, program version, browser, the reporter's role); the full text and the screenshot stay at Supabase in the EU, the report only holds a link valid for 30 days | when someone sends a problem or an idea |
| Microsoft Corporation (Windows Quick Assist) | remote help: at the workshop's request the Provider's staff sees and if needed controls the workshop's Windows 10 or 11 computer (for example to save the old program's data) | USA (DPF, failing certification SCC) | the screen image and the control only as passing traffic; Microsoft keeps the session health data (start, end, errors) for at most 3 days, not the screen content | from 7 December 2026, only when the workshop itself starts the help with a one time code; it can be ended at any time |
| Stripe Payments Europe, Limited (Stripe) | card payment: saving the card and carrying out the charges on the Provider's behalf (processor); for payment transactions, fraud prevention and legal compliance Stripe is an independent controller under its own privacy notice | EU, Ireland; USA (Stripe, LLC: DPF, failing certification SCC) | the payer's name, e-mail, billing data, card data (the Provider never sees card data, only Stripe's reference), the charges | active since 6 November 2026, only for a workshop that chooses card payment (with a separate authorisation before the card is saved); it receives no other workshop's data |
Program code is also on GitHub and never contains customer data. GitHub stores the encrypted daily backup, which it cannot open, and the redacted copy of problem reports (see the table). Please do not write customer data into a problem report; the redaction is automatic but does not recognise everything.
Dictation: dictation uses the browser's built-in speech recognition. In Chrome the audio is processed by Google, in Safari by Apple, under the browser's own terms. Garagevo never receives or stores the audio, only the finished text.
Changes
- 2026-11-07: new sub-processor: Microsoft Corporation (Windows Quick Assist) for remote help, actual use from 7 December 2026 (30 days prior notice, Data Processing Agreement 4.4). Objections or questions: info@garagevo.hu.
- 2026-11-06: Stripe is active, card payment is switched on. By the Provider's decision it was introduced without the 30 day advance notice. Stripe only receives the data of workshops that choose card payment voluntarily; before saving the card they are informed of this separately and give an authorisation. Objections or questions: info@garagevo.hu.