ServeGuard Subprocessor List

Effective date: August 15, 2026

This list identifies the principal third parties that ServeGuard LLC may engage to process personal data in connection with the ServeGuard Restaurant Service and diner-facing services. Capitalized terms have the meanings in the applicable ServeGuard Data Processing Addendum or privacy policy.

ServeGuard may update this list as its services evolve. Material additions that involve a new type of Processing will be posted before the new Subprocessor begins that Processing, subject to emergency security or legal needs. Restaurant customers may submit a reasonable data-protection objection as described in the Data Processing Addendum.

Core infrastructure and service providers

Google Cloud Platform and Firebase

Provider: Google LLC and applicable Google affiliates Primary processing location: United States Purpose: cloud infrastructure, serverless functions, databases, file storage, application hosting, authentication, application integrity controls, logging, crash or diagnostic services, and push-notification infrastructure. Data involved: account identifiers, business and location information, restaurant operational records, diner submissions and identifiers, consent records, reviews, device and security data, files and content, and service logs, depending on the feature used.

Google Workspace and Gmail

Provider: Google LLC and applicable Google affiliates Primary processing location: United States Purpose: transactional and support email, internal business communications, document administration, and authorized customer support. Data involved: names, email addresses, business contact information, message content, support information, and limited account or request context. Allergy submissions are not routinely placed in email and should be included only when necessary for an authorized support matter.

Stripe

Provider: Stripe, Inc. and applicable Stripe affiliates Primary processing location: United States and other locations described by Stripe Purpose: restaurant subscription checkout, recurring billing, invoices, payment authentication, fraud prevention, tax or transaction administration, and payment support. Data involved: restaurant billing contact information, subscription and transaction details, payment-method information, and fraud or device signals. Stripe is used for restaurant billing; diners do not pay ServeGuard through the diner application.

Authentication, distribution, and notifications

Apple

Provider: Apple Inc. and applicable Apple affiliates Primary processing location: locations described by Apple Purpose: App Store distribution, Sign in with Apple for diner authentication, Apple Push Notification service, and account-authorization revocation during Apple-linked account deletion. Data involved: Apple account relay identifiers or email where provided, authentication tokens, app and device identifiers, push tokens, and notification routing data. ServeGuard does not receive the diner's Apple password.

Google Sign-In

Provider: Google LLC and applicable Google affiliates Primary processing location: locations described by Google Purpose: optional Google authentication for diner accounts and provider disconnection during Google-linked account deletion. Data involved: Google account identifier, name and email made available by the user, authentication tokens, and basic sign-in metadata. ServeGuard does not receive the diner's Google password.

Important distinctions

1. A restaurant or caterer that receives a diner submission is a recipient selected by the diner and may be an independent Controller or regulated entity; it is not a ServeGuard Subprocessor.
2. An app store, authentication provider, or payment provider may act independently for some of its own processing under its terms, even when it also performs services for ServeGuard.
3. ServeGuard does not authorize any provider to sell consumer health data, use it for cross-context behavioral advertising, or train a general-purpose artificial-intelligence model on identifiable ServeGuard allergy submissions.
4. ServeGuard currently processes service data primarily in the United States. Provider redundancy, support, security, or legal operations may involve other locations as disclosed by the provider and permitted by contract and law.

Contact

Questions or objections concerning this list may be sent to privacy@serveguardapp.com.

ServeGuard LLC 335 Dunhill Way Dr Alpharetta, GA 30005 United States