Subprocessors

Last updated: June 11, 2026

A subprocessor is a third-party company we rely on to operate BookNox — for hosting, database storage, email delivery, payments, and calendar integration. Each one handles a limited slice of data strictly to provide its service, under its own privacy policy and our data-processing terms. This page lists every subprocessor that handles personal data on our behalf, what it does, and where it operates. For the full picture of what we collect and why, see our Privacy Policy.

BookNox is operated by NetNest Design LLC, a Wyoming limited liability company.

Current subprocessors

• Stripe, Inc. — payment processing and Stripe Connect Express vendor onboarding. Handles: vendor KYC information and client payment details, both collected by Stripe directly through Stripe-hosted forms; BookNox receives only payment metadata. Location: United States. Role: independent controller for the data it collects directly from you; processor for payment routing. Governed by stripe.com/privacy.
• Lemon Squeezy (a Stripe, Inc. company) — merchant of record for vendor subscriptions to the BookNox platform. Handles: vendor billing details and tax-residency information, collected directly through Lemon Squeezy’s hosted checkout; BookNox receives only subscription-state metadata via webhook. Location: United States. Governed by lemonsqueezy.com/privacy.
• Neon, Inc. — Postgres database hosting (via the Vercel Marketplace). Handles: vendor accounts, proposal records, signature audit trails, and booking records. Location: United States.
• Vercel, Inc. — site hosting, server function runtime, domain registration, DNS, and private Blob storage. Handles: all platform data in transit and at rest, including signed PDFs and signature images in private Blob storage, plus standard server logs (request paths and IP-derived geolocation). Location: United States.
• Resend, Inc. — transactional email delivery. Handles: recipient email addresses and the contents of transactional messages (proposal links, signed-contract attachments, deposit receipts, ICS calendar invites, sign-in links). Location: United States.
• Google LLC (Google Calendar API) — calendar event creation, only when a vendor explicitly authorizes it. Handles: an encrypted OAuth token and the booking-event details we write to the vendor’s connected calendar. We write new events only — we do not read existing calendar contents, and the authorization is revocable at any time. Location: United States.

Tools that are not subprocessors

Not every piece of technology we use is a subprocessor. The software libraries, build tools, and runtime components that power BookNox — the ones that never receive a copy of your personal data — are not listed here, because a subprocessor is specifically a third party that processes personal data on our behalf. We do not run third-party advertising trackers, pixels, or analytics scripts on customer-facing pages.

Changes to this list

This list reflects our current subprocessors. We update this page whenever we add, remove, or replace a subprocessor that handles personal data. Active vendors are notified by email — at the address on file — of any material change before it takes effect. To be added to a change-notification list, or to ask a question about any subprocessor, email privacy@booknox.com.