Who else touches the data.
Expenety is operated by BKPCELA d.o.o., Ostrogovićeva ulica 10, 10000 Zagreb, Croatia. These are the companies that process booking data on our behalf, what each one is for, and where they run it. If we add one, this page changes first.
| Company | What it does for us | Where |
|---|---|---|
| Supabase, Inc. | Holds the record itself: the database your booking is written to, the files and photos, and the backups. One private store, one folder for each business. | United States, in the us-east-1 region |
| Cloudflare, Inc. | Hosts this site and the booking page, runs the code behind them, and carries the connection between the page and the record. It also still holds a copy of the booking record from before 2 September 2026. Nothing writes to that copy any more. | United States, and its global network |
| Resend | Sends the email: your confirmation, your reminder, the one question after the visit, and the notice to the business you booked with. | United States |
| Twilio | Sends the text messages where they are switched on: your confirmation, your reminder, and the one question after the visit. | United States |
| Telnyx | The second text sender, used when Twilio is not set up or will not take a message. It also checks that a booked phone number is real and reachable before an estimator drives out. | United States |
| Meta Platforms | Measures the ads that paid for the page. Told that a booking happened, never who you are: any phone or email is hashed before it leaves us. | United States |
| The same, for ads bought on Google. It receives the click identifier and the fact of an appointment, and no name, phone or email at all. | United States |
Coming, and holding nothing yet
Two more are built into the system and have never been given anything. They are here so this page is the first place the change shows up rather than the last.
| Company | What it will do for us | Where |
|---|---|---|
| Fly.io | Will run the screens a business on the system logs into. Nothing runs there today, so it has been given nothing. | United States, Fly's iad region |
| xAI Corp. | Will read your booking so a business owner can ask a plain question about their own numbers and get a plain answer. Every name, phone number, email address and street address is swapped for a placeholder before the request leaves us, and swapped back in the answer on this side. The model is never sent one. The list of what maps to what stays inside that single request and is thrown away with it, and a test in our build fails if a real name or number ever reaches the request. Under our contract with them they keep nothing after answering: the request is not stored and is not used to train their models. | United States |
Who is not on this list
Nobody else. We do not use a data broker, an enrichment vendor beyond the phone check above, an analytics product that profiles visitors, or an advertising network other than the two named. Page views are counted without any identifier at all.
The business you booked with
The contractor is not a subprocessor. They are the business you asked for an estimate from, they decide what they do with your details once we hand them over, and they are responsible for that in their own right. The one practical consequence worth saying out loud: once your booking is in their inbox, it is theirs, and asking us to delete something cannot reach it. Ask them too.
Changes
This page carries the current list. If you are a business on the system and want to be told before a new one is added, say so and we will write it into your agreement.
Last updated 11 September 2026.