PMUezy Subprocessors and Service Providers

External policy or terms | Version 1.0 | 2 October 2026

This schedule distinguishes providers processing Salon data on PMUezy's instructions from services supporting PMUezy's own controller activities and independently controlled services. The exact contracting entity, deployment, countries and transfer safeguard must be populated from the executed vendor documents before this schedule is used to authorise processing. Bracketed fields are completion fields, not assurances about vendor residency.

1 Salon processing providers

Hetzner — core application, database, storage and associated hosting or email services. Main declared deployment: Nuremberg, Germany. Data may include all Salon records hosted by the service. Proposed role: subprocessor for hosted Salon data.

Expo — push relay.

Any additional provider that can access Salon records, including a separately contracted developer business, must be assessed for subprocessor status before access. Individual staff acting under PMUezy's direct authority instead require confidentiality, instructions and access controls. The list is not expanded simply by granting credentials.

2 PMUezy account and platform services

Stripe — Professional subscription and advertising payments. Card details go to Stripe, not PMUezy storage. Stripe's controller and processor roles differ by activity under its agreements; do not classify all payment processing as Salon subprocessing.

GoHighLevel — Professional and Advertiser CRM, support and PMUezy email marketing; name, email, phone and relevant business correspondence. No Salon client records or health content may be uploaded.

Google Analytics — consent gated web analytics on the three web interfaces, with identifiers and events limited by configuration. No health forms, messages, images or account identifiers may be sent in event content or page URLs.

Google Maps — maps and location search; assess queries, coordinates and network information actually transmitted.

Sentry — technical error monitoring with client and health content excluded, and identifiers scrubbed before transmission.

Apple and Google sign in — Client authentication. Apple and Google app distribution also have their own service relationships with users.

Hetzner email — PMUezy's own email operations; email carrying Salon data is also within the subprocessor entry. A Salon's own newsletter provider is selected by the Salon and is its responsibility unless a different arrangement is expressly agreed.

3 Updates and requests

PMUezy provides notice of proposed new or replacement subprocessors under the DPA, ordinarily at least 30 days in advance, with an objection route at privacy@pmuezy.com. Request the completed register and applicable transfer safeguards from that address. Providers must not receive production data while their required contracting, security or transfer fields remain unresolved.