Platform · Legal
Sub-processors
Version of 5 August 2026
What changed: Added Lovable error reporting. Removed unverified assertions that specific data-processing agreements and standard contractual clauses are in place; these now show as outstanding. Removed the claim that the AI provider operates under enterprise terms with no training on submitted content.
GlowFlow uses the third parties below to run the platform. Each is used only to provide the function described, and none of them is permitted to use clinic or client information for its own purposes. Where the written data-processing agreement that records those limits is still being put in place, the transfer-basis column says so rather than implying a signed contract exists. This page is referenced by every clinic's own privacy notice, so a clinic can never publish a shorter list than reality.
Where the platform runs
The GlowFlow database, file storage and application servers are hosted in Ireland, in the European Union. Personal information collected through this platform is therefore transferred out of South Africa and processed in the EU.
Section 72 of POPIA permits a cross-border transfer where the recipient is subject to a law that provides an adequate level of protection. Ireland is subject to the EU General Data Protection Regulation (GDPR), which upholds principles substantially similar to POPIA and includes further-transfer restrictions comparable to section 72.
Cross-border transfers — the current position
Where a sub-processor operates outside South Africa, we currently rely on section 72(1)(a) of POPIA: the recipient is subject to a law, binding corporate rules or a binding agreement that upholds principles for the lawful processing of personal information substantially similar to POPIA, including restrictions on onward transfer. The written data-processing agreements and transfer clauses that would put this beyond doubt for each individual sub-processor are being put in place, and this page will state the position for each one once they are signed.
Core sub-processors (used by every clinic)
| Sub-processor | What it does | What it receives | Where | Transfer basis |
|---|---|---|---|---|
| Lovable (Lovable Labs) | Application hosting and the managed cloud backend the platform runs on. | All platform data, as the hosting layer. | European Union | To be confirmed: transfer basis |
| Lovable (error reporting) | Capturing application errors so faults can be diagnosed and fixed. Runs in the visitor's browser and is not gated behind the cookie banner. | The error message and stack trace, the page path the error occurred on, and any application state included in that trace. A page path can itself identify a clinic, and in some cases a booking or client record. | To be confirmed: processing location | To be confirmed: transfer basis |
| Supabase | Managed PostgreSQL database, authentication and file storage. Supabase states that data is encrypted at rest with AES-256 and in transit via TLS. | Client records, bookings, clinical notes, consent forms, clinical and gallery photographs, staff accounts. | Ireland (European Union) | GDPR-regulated recipient; adequate protection under POPIA section 72(1)(a). |
| Cloudflare | Edge runtime and content delivery. The application server code is built for and runs on the Cloudflare Workers network, so every request to the site passes through it. | Connection metadata and the request itself — IP address, user agent, requested URL, and request/response bodies in transit. No clinical content is stored at the edge. | Global edge network | To be confirmed: transfer basis |
| Google (Fonts) | No longer used. The Inter and Playfair Display font files are now served from this site's own domain, so no request is made to Google's font CDN and no visitor IP address is disclosed to Google. | Nothing. This route has been removed. | Not applicable | Not applicable — no transfer takes place. |
| Resend | Delivery of transactional and marketing email (confirmations, reminders, campaigns). | Recipient name and email address, appointment date, time and treatment name, and the email body itself. | To be confirmed: processing location | To be confirmed: transfer basis |
| SMS Messenger | Delivery of SMS reminders, win-back messages and clinic notifications. | Recipient mobile number, first name and the message text. | South Africa | No cross-border transfer — processed locally. |
| PayFast | Card and instant-EFT payment processing for deposits, retail and subscriptions. | Payer name, email address, amount and a booking reference. Card details are entered on PayFast's own pages and are never seen or stored by GlowFlow. | South Africa | No cross-border transfer — processed locally. |
Optional sub-processors (only if the clinic enables the feature)
| Sub-processor | What it does | What it receives | Where | Transfer basis |
|---|---|---|---|---|
| Meta Platforms (WhatsApp Business) | Sending WhatsApp appointment messages, where the clinic enables WhatsApp. | Recipient WhatsApp number, first name and the message text. | United States, Ireland (European Union) | To be confirmed: transfer basis |
| Google (Gemini models), reached via the Lovable AI gateway | Optional AI features: the owner assistant and the price-list import that reads an uploaded price list. Requests are sent to a Lovable-operated gateway, which forwards them to Google's Gemini models. | Aggregated clinic business figures such as revenue and booking counts, treatment and product names, therapist names, appointment dates and times, and client initials only — no full client names, contact details, clinical notes or photographs. Where the price-list import is used, the contents of the price list the owner uploads. | To be confirmed: processing location | To be confirmed: transfer basis |
| Google (Google Ads conversion tracking) | Measuring which adverts lead to a booking. Loaded only after a visitor accepts optional cookies. | A conversion event with no name, email or treatment detail, plus the identifiers Google's own tag sets in the browser. | United States and European Union | To be confirmed: transfer basis |
What we do not do
- We do not sell personal information, and we do not share it for third-party advertising.
- Clinical notes, consent forms and clinical photographs are never sent to an AI model or to an advertising platform.
- Card numbers never reach GlowFlow — they are entered on PayFast's own pages.
Changes to this list
When we add or replace a sub-processor we update this page and notify clinic owners by email before the change takes effect, so a clinic has the opportunity to raise an objection. Questions go to admin@glowflow.online, and the broader picture is set out in our privacy policy.