We use the carefully chosen third parties below to operate the Covered Beauty platform. Each is bound by its own Data Processing Agreement and has been assessed for technical and organisational security measures. We will notify subscribers at least 30 days before adding or replacing any sub-processor.
| Sub-processor | Purpose | Location | DPA |
|---|---|---|---|
| Supabase Inc. | Database, authentication and file storage | United Kingdom (eu-west-2) | View |
| Vercel Inc. | Web hosting and edge runtime | United States (with EU data residency) | View |
| Stripe Payments Europe Ltd. | Payment processing for booking deposits | Republic of Ireland | View |
| Resend Inc. | Transactional email delivery | United States (Standard Contractual Clauses) | View |
| Microsoft Ireland Operations Limited | Our hello@ inbox, and a backup route for sending email if our main email provider is unavailable, for salons that joined on or after 4 November 2026 | United Kingdom | View |
| ClickSend (Message Media Group) | SMS delivery (appointment reminders and, where enabled, marketing) | Australia / United States (Standard Contractual Clauses) | View |
| WhatsApp Ireland Ltd / WhatsApp LLC (Meta) | WhatsApp delivery of booking messages, only for salons that connect their own WhatsApp number and clients who choose WhatsApp | Ireland / United States (WhatsApp Business data transfer addenda, including the UK addendum) | View |
| Functional Software Inc. (Sentry) | Application error monitoring | United States (Standard Contractual Clauses) | View |
| Cloudflare Inc. | Bot protection on forms (Turnstile) | United States / EU (Standard Contractual Clauses) | View |
| Google Ireland Ltd. | Google Calendar two-way sync, for salons that connect it | Republic of Ireland / United States | View |
| Anthropic, PBC | AI assistant (Claude), only when a salon sends us its client list, bookings or other records and asks us to put them in or sort them out, or asks its dashboard to read its reviews from Fresha or photos of its sunbed minutes cards (from sign-up for salons that joined on or after 3:30pm on 2 November 2026, and from 2 December 2026 for salons that joined before then and got our email about it on 2 November 2026) | United States (Standard Contractual Clauses) | View |
For emails about a salon’s own account, Microsoft works for us rather than for salons, so for that work it isn’t a sub-processor under our Data Processing Agreement. Its backup role for any email that holds clients’ details, including emails to clients, applies only to salons that joined on or after 4 November 2026. If you joined before then, your clients’ emails don’t go through Microsoft.
Reading your reviews from Fresha and photos of your minutes cards on the dashboard opens on 2 December 2026 if your salon joined before 3:30pm on 2 November 2026 and we emailed you about Anthropic that day. If your salon joined before then and we didn’t email you, the dashboard doesn’t read them.
Website analytics
Separately, we use Google Analytics on our own public marketing website when a visitor allows analytics cookies. HAMR Ltd is the controller for this website analytics. It does not include salon client records, account pages or client booking journeys. This is separate from processing salon data under the Data Processing Agreement above.
Google may process this information outside the UK. See its data processing terms and our cookie policy.
Notifications
We will notify the account owner by email at least 30 days before any new sub-processor begins processing personal data. If you object to a new sub-processor, please contact us at hello@covered.technology within the notice period.
Covered Beauty is a trading name of HAMR Ltd. Registered in England and Wales. Company no. 17190046
25 Lowther Street, Whitehaven, CA28 7DG
© 2026 HAMR Ltd. All rights reserved.