Sub-processors

Version 1.0 · Last updated 2 October 2026

Understory A/S and Understory Iberia S.L.U. (together “Understory”) use the sub-processors listed on this page to deliver the Understory platform. This list forms part of Appendix B of our data processing agreements with customers.

Which means

These are the companies that handle your guests’ data on our behalf when we run the platform for you. We tell you before we add or replace one, and you can object.

How we tell you about changes

We notify customers of any intended addition or replacement of a sub-processor at least 30 days before it starts processing personal data on their behalf, where our agreement with that sub-processor allows it, and otherwise as soon as we receive notice ourselves. Notice is sent to the contact person registered in the customer’s account, and every change is recorded in the change log at the bottom of this page.

A customer may object within 14 days of the notice, on reasonable grounds relating to data protection, by writing to privacy@understory.io. Sub-processors introduced by a module or feature that the customer chooses to activate are accepted as part of that activation, as set out in the data processing agreement.

Understory group companies

The Understory company you have your agreement with uses the other group company as a sub-processor. Understory A/S operates the platform for all customers. Understory Iberia S.L.U. provides customer success and support for all customers.

Understory A/S

Vestergade 4, 2., 8000 Aarhus C, Denmark · CVR 43717960

Purpose

Operation, hosting, maintenance and support of the Understory platform

Data location

Denmark (EU)

Transfer basis

Not applicable (EU/EEA)

Applies to

Customers of Understory Iberia S.L.U.

Engaged by

Understory Iberia S.L.U.

Carrer de la Ciutat de Granada, 68, Sant Martí, 08005 Barcelona, Spain · NIF B93867794

Purpose

Customer success and support, with access to customer accounts in the platform

Data location

Spain (EU)

Transfer basis

Not applicable (EU/EEA)

Applies to

Customers of Understory A/S

Engaged by

Understory A/S

Third-party sub-processors

The following sub-processors are engaged by Understory A/S in connection with the operation of the platform.

Amazon Web Services EMEA SARL

38 Avenue John F. Kennedy, L-1855 Luxembourg

Purpose

Hosting, backup and operation of the platform

Data location

EU (eu-west-1, Ireland)

Transfer basis

Not applicable (EU/EEA)

Applies to

All customers

Engaged by

Understory A/S

Vercel Inc.

440 N Barranca Ave #4133, Covina, CA 91723, USA

Purpose

Hosting of storefronts and API layer

Data location

EU (Ireland)

Transfer basis

EU-U.S. Data Privacy Framework certification and the 2021 Standard Contractual Clauses

Applies to

All customers

Engaged by

Understory A/S

Algolia SAS

55 Rue d'Amsterdam, 75008 Paris, France

Purpose

Search within the Backoffice (guest name, email, phone and order data)

Data location

Transfer basis

Not applicable (EU/EEA)

Applies to

All customers

Engaged by

Understory A/S

Mailgun Technologies, Inc.

112 E. Pecan St. #1135, San Antonio, TX 78205, USA

Purpose

Transactional email

Data location

Transfer basis

EU-U.S. Data Privacy Framework certification, with the 2021 Standard Contractual Clauses (Module 3) as fallback

Applies to

All customers

Engaged by

Understory A/S

360dialog GmbH

Tölzer Straße 1, 82031 Grünwald, Germany

Purpose

WhatsApp message delivery. Onward sub-processors: WhatsApp Ireland Limited and Google Ireland Limited (Google Cloud, Frankfurt)

Data location

EU/EEA

Transfer basis

Not applicable (EU/EEA)

Applies to

Customers using WhatsApp messaging

Engaged by

Understory A/S

inMobile ApS

Axel Kiers Vej 18L, 8270 Højbjerg, Denmark

Purpose

SMS delivery

Data location

Denmark (EU)

Transfer basis

Not applicable (EU/EEA entity)

Applies to

Customers using SMS messaging

Engaged by

Understory A/S

Dash0 Inc

169 Madison Ave STE 38218, New York, NY 10016, USA

Purpose

Observability and telemetry

Data location

EU (eu-west-1, Ireland)

Transfer basis

2021 Standard Contractual Clauses (Module 3)

Applies to

All customers

Engaged by

Understory A/S

Google Ireland Limited

Gordon House, Barrow Street, Dublin 4, Ireland

Purpose

Advertising

Data location

EU entity

Transfer basis

Onward transfers outside the EU/EEA on the basis set out in Google’s Ads Data Processing Terms

Applies to

Social Ads customers only

Engaged by

Understory A/S

OpenAI Ireland Ltd.

1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland

Purpose

Generation of textual marketing content

Data location

EU entity, with onward transfers to the United States

Transfer basis

2021 Standard Contractual Clauses (Module 3) for onward transfers

Applies to

Customers using AI features

Engaged by

Understory A/S

Anthropic Ireland, Limited

6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland

Purpose

Generation of textual marketing content and analysis of guest reviews for the customer

Data location

EU entity, with onward transfers to the United States

Transfer basis

2021 Standard Contractual Clauses (Module 3) for onward transfers

Applies to

Customers using AI features or review insights

Engaged by

Understory A/S

Who is not on this list

Payment providers such as Stripe, Adyen (Understory Pay) and PayPal are not sub-processors. The customer holds its own account with the provider and contracts with it directly.

Advertising and analytics platforms that the customer connects using its own account, such as Meta, receive data on the customer’s instruction and act as independent controllers or as the customer’s own processors.

Services that Understory uses for its own purposes as an independent controller, such as product analytics and customer relationship management, are described in the Understory privacy policy.

Change log

2 October 2026 · Version 1.0

First published list. Adds Understory Iberia S.L.U. as a sub-processor for customer success and support.