Sub-processors
Version 2026-09-04. We give venues 30 days' notice before adding a provider that processes personal information.
Used for every venue
| Provider | Purpose | Information | Where | Contract |
|---|---|---|---|---|
| Supabase | Database, sign-in, file storage | All platform data | Australia (Sydney) | Mavos |
| Vercel | Hosting and application logs | Request metadata, network addresses, error logs with tenant identifiers | Australia (compute); logs per Vercel's terms | Mavos |
| Stripe | Payments, card readers, payouts | Customer name and email for receipts, amounts, venue KYC | Global; accounts registered in Australia | Mavos and the venue's connected account |
| Sentry | Error monitoring | Error reports, request URLs and headers, breadcrumbs, tenant identifiers | United States | Mavos |
| PostHog | Product analytics on staff screens and this website | Feature usage, device data, tenant identifier | United States | Mavos |
| Cloudflare | Bot protection on public forms | Network address | Global | Mavos |
| Google, Apple and Mozilla push services | Roster and marketing notifications you opt in to | Notification text, including shift details and names | United States | Mavos |
| EMQX | Connection to automation devices | Device identifiers and readings | Singapore | Mavos |
Enabled by a venue with its own account
When a venue turns these on, the venue is that provider's customer and Mavos transmits the information the venue has configured.
| Provider | Purpose | Information | Where | Contract |
|---|---|---|---|---|
| OpenRouter and the AI model providers it routes to (OpenAI, Anthropic, Google and others) | AI assistants and image generation | Whatever the assistant reads to answer: customer and employee records, orders, wiki content, menu images, supplier documents | United States, then the model provider's region | Venue |
| Resend | Transactional and marketing email | Recipient email and name, message content, open and click events | Per provider | Venue |
| Google Gmail and Drive | Email sending, supplier-invoice inbox reading, document import | Mailbox and document contents | Per provider | Venue OAuth on the Mavos client |
| Twilio | SMS | Phone numbers and message text | United States | Venue |
| Xero | Accounting and payroll | Supplier contacts, employee identifiers and hours | Per provider | Venue OAuth on the Mavos client |
| FreshKDS | Kitchen display | Order contents, customer name and phone, delivery address | United States | Venue |
| Meta (Pages, Instagram, Ads, Pixel, WhatsApp) | Marketing publishing, advertising and WhatsApp messaging | Pseudonymous identifiers and conversion values; WhatsApp messages | United States | Venue OAuth on the Mavos client |
| Google Ads, Business Profile, Search Console, Analytics and Tag Manager | Marketing publishing, advertising and, with your consent, tracking | Campaign data; pseudonymous analytics identifiers and events | United States | Venue OAuth on the Mavos client |
| TikTok Content Posting | Video publishing | Video assets, account tokens | Singapore / United States | Venue OAuth on the Mavos client |
| Plausible | Cookieless website analytics | Page URL, network address at the vendor | European Union | Venue |
| Your own webhook endpoints | Developer API events you subscribe to | Order and customer fields you choose | Wherever your endpoint runs | Venue |