Sous-traitants ultérieurs
Dernière mise à jour : 13 novembre 2026
Deskadora informe ses clients restaurateurs, avec un préavis de 30 jours, de tout ajout ou remplacement d'un sous-traitant ultérieur figurant sur cette liste, par e-mail et par mise à jour de la présente page. Les clients peuvent s'opposer à une modification conformément au accord de sous-traitance des données.
| Sous-traitant ultérieur | Service | Catégories de données | Lieu de traitement | Garantie de transfert |
|---|---|---|---|---|
| Amazon Web Services EMEA SARL (AWS), compute | Hébergement de la plateforme : serveurs d'application, base de données et gestionnaire de files d'attente | All platform data | eu-west-3 (Paris), France | EU, no transfer |
| Amazon Web Services EMEA SARL (AWS), object storage | Stockage d'objets pour les fichiers téléversés et les médias (images de menus et d'établissements, factures, exports de données) et sauvegardes de la base de données | Menu and venue images, invoices, data exports; database backups contain all platform data and are held in the same bucket region | eu-west-2 (London), United Kingdom | UK adequacy decision (European Commission), no Standard Contractual Clauses needed |
| Amazon Web Services EMEA SARL (AWS), SES | E-mails de campagnes marketing | Recipient email address and name, campaign content, tracking identifiers | eu-west-3 (Paris), France | EU, no transfer |
| Stripe Payments Europe, Limited; Stripe, Inc. | Paiements : facturation des abonnements, acomptes des clients, intégration Connect et vérifications d'identité | Venue and representative identity and billing data; guest card data (entered directly with Stripe) and booking reference | Ireland and United States (region not pinned in our configuration) | Stripe Data Processing Agreement (last updated 28 September 2026), incorporated in the Stripe Services Agreement, and Stripe Data Transfers Addendum (last updated 18 November 2025): EU-US Data Privacy Framework (Stripe, LLC), Standard Contractual Clauses (modules 1 to 3) and the UK International Data Transfer Addendum; covers Connect. The Operator's platform account collects the application fee only and carries no Stripe processing fee on it |
| Twilio Inc.; Twilio Ireland Limited | Téléphonie et signalisation SMS : SMS, vérification téléphonique, numéros de l'assistant vocal, transfert d'appel | Phone numbers, SMS content, call audio in transit. No call audio is retained: the trunks are set not to record, and five legacy test recordings were deleted on 1 October 2026. Message logs are kept 30 days from 9 October 2026 (before: 400 days), backup storage is off, redaction of the message body has been requested from Twilio (pending); call logs are kept for Twilio's default period | United States (region US1) | Twilio Data Protection Addendum (last updated 9 April 2026), incorporated in the Twilio agreement: EU-US Data Privacy Framework (Twilio Inc., with the UK Extension) and Standard Contractual Clauses (modules 1 to 3); the UK International Data Transfer Agreement for UK transfers |
| LiveKit, Inc. | Flux multimédia en temps réel pour l'assistant vocal (salles audio et téléphonie) | Live call audio, caller number. Agent observability is on: traces, transcripts and audio of calls are kept at LiveKit in the European Union (Frankfurt) for 30 days on every plan and deleted automatically; personal data redaction (name, contact details, demographics, credentials, network, financial, location and identifiers) applies to new sessions since 9 October 2026, is best effort and detects personal data in English only | European Union (Frankfurt): the project used for EU venues is pinned to the European Union; a second project (United States, observability off) is legacy and unused for EU venues | LiveKit Data Processing Addendum (last updated 6 October 2026), part of LiveKit's terms: EU-US Data Privacy Framework, then Standard Contractual Clauses (modules 1 to 3) and the UK International Data Transfer Addendum |
| Deepgram, Inc. | Reconnaissance vocale pour l'assistant vocal | Live call audio, venue and menu keywords. Deepgram keeps request metadata logs (request parameters, which include venue and menu keywords, and timestamps) | Deepgram, Inc. (United States). Requests go to the EU endpoint (api.eu.deepgram.com) since 2 October 2026; non-dedicated deployment, so EU residency is not contractually guaranteed (DPA section 9.2 applies only to Deepgram Dedicated) | Data processing agreement signed 6 October 2026 (Deepgram standard DPA, May 2026): Standard Contractual Clauses (Modules 2 and 3, Irish law and courts) and the UK Addendum, incorporated in the DPA (sections 9.3 to 9.5). Opted out of Deepgram's Model Improvement Program on every speech-to-text request from 2 October 2026 (mip_opt_out=true, a per-request setting). Every request to Deepgram carries the no-retention, no-training setting (mip_opt_out); audio and transcripts are processed in memory and not stored by Deepgram, other than request metadata (parameters and timestamps). |
| Cartesia | Synthèse vocale pour l'assistant vocal | Assistant reply text (may include a guest's name and booking details) | United States (Cartesia offers no region setting on the current plan) | Cartesia data processing agreement, part of its Terms of Service: Standard Contractual Clauses (Module 2), the EU-US Data Privacy Framework where applicable, UK Addendum. Default retention applies, zero data retention is not enabled (Enterprise plan only): personal data kept as long as the purpose requires and deleted within 180 days after termination (verified 2 October 2026) |
| Soniox | Reconnaissance et synthèse vocales pour le roumain | Live call audio, assistant reply text | EU region (EU hosts, confirmed from the running configuration) | EU, no transfer. Data Processing Agreement signed on 1 October 2026 |
| Anthropic, PBC | Modèle de langage (traduction des menus, suggestions d'allergènes, analyse des demandes des clients, briefings clients, attribution des tables, analyses, extraction de menus, traduction de campagnes, assistant de conversation WhatsApp, assistant vocal) | Venue content; guest free-text requests and notes; guest profile attributes; WhatsApp chat text; live call transcript and, for recognised callers, name, email, dietary flags and upcoming bookings | United States. Inputs and outputs retained 30 days (organisation setting, checked 2 October 2026); zero data retention requested from Anthropic on 2 October 2026 and declined, so the 30-day retention applies | Anthropic Data Processing Addendum (effective 24 February 2025), incorporated in the Commercial Terms of Service, including Standard Contractual Clauses (modules 2 and 3) and the UK Addendum |
| Meta Platforms Ireland Limited; Meta Platforms, Inc. (WhatsApp Business Platform) | Messagerie WhatsApp : réservations, notifications, Flows, Embedded Signup | Phone number, message content, booking details, name and email | Ireland and United States | WhatsApp Business Data Processing Terms (22 August 2025) and WhatsApp Business Data Transfer Addendum (16 February 2024), incorporated in the WhatsApp Business Terms (WhatsApp Ireland Limited): EU-US Data Privacy Framework for transfers to WhatsApp LLC and Meta Platforms, Inc., Standard Contractual Clauses (processor to processor) for onward transfers; a separate UK addendum applies to UK transfers |
| Meta Platforms Ireland Limited; Meta Platforms, Inc. (Pixel and Conversions API) | Mesure publicitaire, avec consentement | Hashed contact details, IP address, user agent, browser identifiers | Ireland and United States | Meta Business Tools Terms (3 November 2025), which incorporate Meta's Data Processing Terms (23 August 2025) and the Meta European Data Transfer Addendum (effective 7 September 2023): EU-US Data Privacy Framework as the primary mechanism (Meta Platforms, Inc. certified, Meta Ireland relies on the adequacy decision), processor-to-processor Standard Contractual Clauses (module 3) as the fallback, for the EU, the EEA and Switzerland; same entity as for WhatsApp (Meta Platforms Ireland Limited) |
| Google Ireland Limited; Google LLC | Gmail SMTP (e-mails transactionnels), Firebase Cloud Messaging (notifications push, avec Apple APNs pour iOS), Google Analytics 4 (avec consentement), Maps Platform (cartes et recherche d'adresses) | Email recipients and content; push tokens and notification text (guest name, date, time, party size); analytics identifiers and IP address; address search text | Not pinned in our configuration; Google's processing locations under the terms in the next column | Google Analytics 4: Google Ads Data Processing Terms (version 8.0, 30 May 2024; accepted by Deskadora on 30 October 2024), Standard Contractual Clauses. Firebase Cloud Messaging: Firebase Data Processing and Security Terms (last modified 21 August 2024), incorporated in the Firebase agreement, EU-US Data Privacy Framework and Standard Contractual Clauses. Gmail SMTP and Google Cloud services: Cloud Data Processing Addendum (Customers), last modified 8 June 2026, incorporated in the agreement: Google's Customer Standard Contractual Clauses (controller to processor, processor to processor, processor to controller) or an alternative transfer solution if Google adopts one; UK GDPR and the Swiss FADP are in scope of the terms. Maps Platform: Google Controller-Controller Data Protection Terms (version 11, 7 May 2026), the EU-US Data Privacy Framework and controller-to-controller Standard Contractual Clauses |
| Squareup International Ltd (Ireland); Square, Inc. | Intégration de caisse (synchronisation des commandes et du menu), uniquement lorsque l'établissement l'active et sur instruction de celui-ci | Guest names, contact details, order history, reservation details (Terms Annex I17) | Per Square's terms for the venue's own account | Square General Data Processing Terms for the EEA and the United Kingdom (https://square.com/ie/legal/data-processing-terms), Square acting as processor. Transfers outside the EEA or UK are covered by safeguards that Square names as including standard contractual clauses and other recognised mechanisms, provided on written request ([email protected]) |
| MaxMind, Inc. | Géolocalisation (adresse IP vers pays et ville) | None. A local database is used and no personal data is sent to MaxMind | Local database on the Paris host | Not applicable, no transfer |
| Cloudflare, Inc. | CDN, pare-feu applicatif web, protection anti-bots Turnstile | Web traffic in transit (IP address, headers); Turnstile token | Global network (no region pinned) | Cloudflare Customer DPA with Standard Contractual Clauses; the EU-US Data Privacy Framework certification is noted |
| Functional Software, Inc. (Sentry) | Suivi des erreurs et des performances ; relecture de session dans le navigateur, chargée uniquement après acceptation des cookies d'analyse par le visiteur, limitée aux erreurs, avec tout le texte et toutes les saisies masqués et les médias bloqués, jamais en enregistrement continu, et arrêtée lorsque le consentement à l'analyse est retiré | Error data and page context; IP addresses are not stored ("prevent storing IP addresses" and the required data scrubbers are on since 9 October 2026); after analytics consent only, a masked replay of the page around an error; events are kept 30 days | EU data region (Frankfurt, ingest.de.sentry.io) for error and performance data; Sentry keeps organization account data (users, tokens, settings, audit logs) in the United States | Sentry Data Processing Addendum 5.1.0 (29 May 2024), accepted by Deskadora on 9 October 2026 by electronic acceptance: EU-US Data Privacy Framework, Standard Contractual Clauses (modules 2 and 3) and the UK Addendum; the error data itself stays in the EU region |
Notes
- Hébergés par Deskadora elle-même sur l'hôte de Paris et non par des tiers : la base de données, le gestionnaire de files d'attente, la pile de supervision et le système de gestion de contenu utilisé pour les pages de politiques et le blog.
- Le client d'IA propre à un propriétaire d'établissement, connecté via le connecteur propriétaire (par exemple Claude ou ChatGPT), est le propre service du propriétaire et n'est pas un sous-traitant ultérieur de Deskadora.
- Stripe, Meta et Google agissent en tant que responsables du traitement indépendants pour certaines finalités (par exemple Stripe pour la prévention de la fraude et ses obligations réglementaires, Meta et Google pour leurs propres données publicitaires et de compte). Pour ces finalités, ils ne sont pas des sous-traitants ultérieurs de Deskadora.
- Les prestataires de systèmes de point de vente (Zelty, Square) sont les fournisseurs propres de l'établissement. Deskadora ne leur transmet des données que lorsque l'établissement active l'intégration et sur instruction de celui-ci. Zelty traite les données en France ; Square figure dans le tableau ci-dessus.