Services shared by all applications
Section updated to version 1.0 of 11 October 2026
Services all applications rely on: single sign-on (Promethea Account), the consent register and the shared infrastructure.
| Supplier | What it does for us | Data processed | Role | Where the data are | Transfer outside the EEA |
|---|---|---|---|---|---|
| Anthropic PBC US |
Provides the AI models used by the apps' AI features | Identification data Content entered in the app |
Processor (Art. 28) | US | Standard contractual clauses (Art. 46) |
| Apple Inc. US |
Delivers notifications to the user's browser: receives a technical device identifier; the notification text is encrypted and not readable by the provider. | Technical data (IP, logs, device) | Recipient | US (rete globale Apple) | Standard contractual clauses (Art. 46) |
| Aruba S.p.A. IT |
Sends the apps' automatic e-mails (confirmations, notices, receipts): receives the recipient's address and the message text. | Contact data Content entered in the app |
Processor (Art. 28) | IT | No transfer: data in the EEA |
| Better Stack US |
Checks that the apps are up and publishes the status page | Technical data (IP, logs, device) | Processor (Art. 28) | US | EU-US Data Privacy Framework |
| Cloudflare Inc. US |
Hosts the web apps and the consent registry, and delivers their traffic | Identification data Technical data (IP, logs, device) |
Processor (Art. 28) | rete anycast globale (nessuna region singola) | EU-US Data Privacy Framework |
| DigitalOcean LLC US |
Hosts the single sign-on service for all apps | Identification data Technical data (IP, logs, device) Login credentials |
Processor (Art. 28) | fra1 (Francoforte) | EU-US Data Privacy Framework |
| Google LLC US |
Delivers notifications to the user's browser: receives a technical device identifier; the notification text is encrypted and not readable by the provider. | Technical data (IP, logs, device) | Recipient | US (rete globale Google) | EU-US Data Privacy Framework |
| Microsoft Corporation US |
Delivers notifications to the user's browser: receives a technical device identifier; the notification text is encrypted and not readable by the provider. | Technical data (IP, logs, device) | Recipient | US (rete globale Microsoft) | EU-US Data Privacy Framework |
| Mozilla Corporation US |
Delivers notifications to the user's browser: receives a technical device identifier; the notification text is encrypted and not readable by the provider. | Technical data (IP, logs, device) | Recipient | US (rete globale Mozilla) | Standard contractual clauses (Art. 46) |
| Neon (Databricks) US |
Database of the ecosystem's single sign-on (accounts and logins) | Identification data Contact data Technical data (IP, logs, device) Login credentials |
Processor (Art. 28) | eu-central-1 (Francoforte, Germania) | Standard contractual clauses (Art. 46) |
| Neon (Databricks) US |
Register of legal document acceptances | Identification data Technical data (IP, logs, device) Content entered in the app |
Processor (Art. 28) | eu-central-1 (Francoforte, Germania) | Standard contractual clauses (Art. 46) |
| Openapi S.p.A. IT |
Electronic signature of contracts | Identification data Contact data Technical data (IP, logs, device) Content entered in the app |
Processor (Art. 28) | IT | No transfer: data in the EEA |
| Openapi S.p.A. IT |
E-invoicing via the Italian Exchange System (SdI) | Contact data Tax data |
Processor (Art. 28) | IT | No transfer: data in the EEA |
| Openapi S.p.A. IT |
Company data checks in the business register | Identification data Contact data Tax data |
Processor (Art. 28) | IT | No transfer: data in the EEA |
| OpenStreetMap Foundation GB |
Finds cities and addresses and returns their coordinates: receives only the search text or address and connection data (IP address, browser). | Technical data (IP, logs, device) Content entered in the app |
Recipient | GB | Adequacy decision (Art. 45) |
| Railsware Products Studio LLC US |
Sends the sign-in emails and the apps' communications | Identification data Contact data Content entered in the app |
Processor (Art. 28) | US | EU-US Data Privacy Framework |
| Stripe Inc. US |
Payment of Promethea subscriptions | Identification data Contact data Technical data (IP, logs, device) Payment data Tax data |
Processor (Art. 28) Independent controller |
USA e UE (non scelta da noi) | EU-US Data Privacy Framework |
| Supabase Inc. US |
App database and file storage | Identification data Contact data Technical data (IP, logs, device) Tax data Content entered in the app |
Processor (Art. 28) | eu-west-1 (Dublino, Irlanda) | Standard contractual clauses (Art. 46) |
Plathea
Section updated to version 1.0 of 11 October 2026
| Supplier | What it does for us | Data processed | Role | Where the data are | Transfer outside the EEA |
|---|---|---|---|---|---|
| Google LLC US |
Delivers push notifications to installed apps: receives a technical device identifier and the notification text. | Technical data (IP, logs, device) Content entered in the app |
Processor (Art. 28) | US (rete globale Google) | EU-US Data Privacy Framework |
| Meta Platforms Ireland Limited IE |
Publishes to the business's Facebook and Instagram pages the posts the business creates in the app: receives the text, images and the authorisation granted by the business. | Identification data Content entered in the app Login credentials |
Independent controller | US, IE, DK, SE (data center Meta) | Standard contractual clauses (Art. 46) |
| Openapi S.p.A. IT |
Transmission of receipts to the Italian Revenue Agency | Tax data | Processor (Art. 28) | IT | No transfer: data in the EEA |
| Stripe Inc. US |
End-customer payments to the business using the app (venue, organiser, salon), via Stripe Connect | Identification data Contact data Technical data (IP, logs, device) Payment data Tax data |
Processor (Art. 28) Independent controller |
USA e UE (non scelta da noi) | EU-US Data Privacy Framework |
| Supabase Inc. US |
App database and file storage | Identification data Contact data Technical data (IP, logs, device) Tax data Content entered in the app |
Processor (Art. 28) | eu-north-1 (Stoccolma, Svezia) | Standard contractual clauses (Art. 46) |
Eventhea
Section updated to version 1.0 of 11 October 2026
| Supplier | What it does for us | Data processed | Role | Where the data are | Transfer outside the EEA |
|---|---|---|---|---|---|
| Meta Platforms Ireland Limited IE |
Publishes to the business's Facebook and Instagram pages the posts the business creates in the app: receives the text, images and the authorisation granted by the business. | Identification data Content entered in the app Login credentials |
Independent controller | US, IE, DK, SE (data center Meta) | Standard contractual clauses (Art. 46) |
| Openapi S.p.A. IT |
Transmission of receipts to the Italian Revenue Agency | Tax data | Processor (Art. 28) | IT | No transfer: data in the EEA |
| Stripe Inc. US |
End-customer payments to the business using the app (venue, organiser, salon), via Stripe Connect | Identification data Contact data Technical data (IP, logs, device) Payment data Tax data |
Processor (Art. 28) Independent controller |
USA e UE (non scelta da noi) | EU-US Data Privacy Framework |
| Supabase Inc. US |
App database and file storage | Identification data Contact data Technical data (IP, logs, device) Content entered in the app |
Processor (Art. 28) | eu-west-3 (Parigi, Francia) | Standard contractual clauses (Art. 46) |
Essenthea
Section updated to version 1.0 of 11 October 2026
| Supplier | What it does for us | Data processed | Role | Where the data are | Transfer outside the EEA |
|---|---|---|---|---|---|
| Meta Platforms Ireland Limited IE |
Publishes to the business's Facebook and Instagram pages the posts the business creates in the app: receives the text, images and the authorisation granted by the business. | Identification data Content entered in the app Login credentials |
Independent controller | US, IE, DK, SE (data center Meta) | Standard contractual clauses (Art. 46) |
| Openapi S.p.A. IT |
Transmission of receipts to the Italian Revenue Agency | Tax data | Processor (Art. 28) | IT | No transfer: data in the EEA |
| Stripe Inc. US |
End-customer payments to the business using the app (venue, organiser, salon), via Stripe Connect | Identification data Contact data Technical data (IP, logs, device) Payment data Tax data |
Processor (Art. 28) Independent controller |
USA e UE (non scelta da noi) | EU-US Data Privacy Framework |
| Supabase Inc. US |
App database and file storage | Identification data Contact data Technical data (IP, logs, device) Tax data Content entered in the app |
Processor (Art. 28) | eu-west-1 (Dublino, Irlanda) | Standard contractual clauses (Art. 46) |
Cronothea
Section updated to version 1.0 of 11 October 2026
| Supplier | What it does for us | Data processed | Role | Where the data are | Transfer outside the EEA |
|---|---|---|---|---|---|
| Supabase Inc. US |
App database and file storage | Identification data Contact data Technical data (IP, logs, device) Content entered in the app |
Processor (Art. 28) | eu-central-1 (Francoforte, Germania) | Standard contractual clauses (Art. 46) |
YUVI
Section updated to version 1.0 of 11 October 2026
| Supplier | What it does for us | Data processed | Role | Where the data are | Transfer outside the EEA |
|---|---|---|---|---|---|
| Aruba S.p.A. IT |
Website hosting | Technical data (IP, logs, device) | Processor (Art. 28) | IT | No transfer: data in the EEA |
| Supabase Inc. US |
App database and file storage | Identification data Contact data Technical data (IP, logs, device) Content entered in the app |
Processor (Art. 28) | eu-central-1 (Francoforte, Germania) | Standard contractual clauses (Art. 46) |
Accounthea
Section updated to version 1.0 of 11 October 2026
| Supplier | What it does for us | Data processed | Role | Where the data are | Transfer outside the EEA |
|---|---|---|---|---|---|
| Supabase Inc. US |
App database and file storage | Identification data Contact data Technical data (IP, logs, device) Payment data Tax data Content entered in the app |
Processor (Art. 28) | eu-west-1 (Dublino, Irlanda) | Standard contractual clauses (Art. 46) |
Sito prometheasrl.it
Section updated to version 1.1 of 11 October 2026
| Supplier | What it does for us | Data processed | Role | Where the data are | Transfer outside the EEA |
|---|---|---|---|---|---|
| Aruba S.p.A. IT |
Website hosting | Technical data (IP, logs, device) | Processor (Art. 28) | IT | No transfer: data in the EEA |
| Aruba S.p.A. IT |
Hosts the company email mailboxes. | Identification data Contact data Content entered in the app |
Processor (Art. 28) | IT | No transfer: data in the EEA |