SarucciAuthorised Sub-processors
As of the Effective Date, Provider engages the sub-processors listed in the table below. Where a sub-processor is identified below by category rather than by name, Provider will identify the engaged entity and its location on the sub-processor page before that sub-processor begins processing Personal Data. An up-to-date list, including entity names and locations, is maintained at sarucci.com/sub-processors and is incorporated by reference into this Annex.
| Sub-processor / Category | Purpose of Processing | Location of Processing |
|---|---|---|
| Google Cloud EMEA Limited / Google LLC (Google Cloud Platform) | Hosting and execution of the Platform, managed database services, object storage, asynchronous task queues, container registry and scheduled jobs | European Union (Belgium) and United Kingdom (London) |
| Google LLC / Google Cloud EMEA Limited (Firebase — Hosting, Authentication, Cloud Firestore) | Delivery of the Platform web application, user authentication and storage of user-configured application state | European Union and United States |
| Amazon Web Services EMEA SARL / Amazon Web Services, Inc. | Supplementary hosting, compute and storage for Platform services | European Union (Ireland and Frankfurt) and United States |
| Zoho Corporation Private Limited | Delivery of transactional and system email (account, security, rate-publishing and report notifications) and operation of the support mailbox | India and European Union |
| Anthropic PBC | Large language model processing for the Platform’s AI analyst, AI consultant and agentic advisor features | United States |
| OpenAI Ireland Limited / OpenAI, L.L.C. | Large language model processing, embeddings and document retrieval for the Platform’s AI features | European Union and United States |
| Google LLC (Gemini API) | Large language model processing for the Platform’s AI features | European Union and United States |
| RunPod, Inc. | GPU compute for the Platform’s real-time voice consultant (speech recognition, speech synthesis and avatar rendering) and for machine learning model training | European Union and United States |
| Google Maps Platform (Google LLC) | Map rendering and geocoding on the Platform’s market and competitor intelligence screens | European Union and United States |
| Analytics provider | Anonymised and aggregated Platform usage analytics | European Union and United States |
| Stripe Payments Europe, Limited / Stripe, Inc. | Subscription billing, invoicing and payment processing. No payment card data is stored by Provider | Ireland and United States |
Provider will give Client at least thirty (30) days’ advance written notice of any new or replacement sub-processor, in accordance with Section 4 of this DPA.
For the avoidance of doubt, property management systems and other third-party systems that Client connects to the Platform — including Oracle OPERA Cloud (OHIP) and Cloudbeds — are not sub-processors of Provider. Where Client authorises such a connection, Provider exchanges Client Data with that system on Client’s instruction, and Client’s relationship with that system’s provider is governed by Client’s own agreement with it.