Subprocessors

Arvo's subprocessors

Updated 3 November 2026 · Draft for legal review

Arvo runs the Flight Delay Pass for each Underwriter, which is responsible for its travellers' data. These providers process that data for Arvo, under contracts that hold them to the same standard. Each Underwriter's Privacy Notice links this page, and so does Arvo's privacy notice.

• Render: hosting and file storage. Data: everything Arvo keeps. Where: Singapore.
• Amazon Web Services: the database, which holds everything Arvo keeps, in Singapore; storage, encrypted and locked against change, of each pass's record once it's sold, ends and its accounts close, kept for as long as the Underwriter must keep it; and the emails we receive and send. Data: everything a pass's record holds, and those emails. Where: the AWS region that serves the country where you bought the pass.
• Postmark: sending and receiving email. Data: forwarded bookings, and the emails we send. Where: United States.
• Twilio: WhatsApp messages and phone checks. Data: mobile number, and the messages we send. Where: United States.
• Meta (WhatsApp), through Twilio: delivering our WhatsApp messages. Data: mobile number, and the messages we send. Where: United States, and other countries it operates in.
• Stripe: payments. Data: card details you type at checkout, name, email, amount. Where: United States.
• Airwallex: issuing pre-loaded rescue cards, identity and sanctions checks. Data: legal name, date of birth, home address, email, mobile number. Where: Singapore, and other countries it operates in.
• Sentry: error tracking, so we hear at once when something in the service fails. Data: where in our code an error happened and which page or job it was in; we strip personal details before an error is sent, so it should hold none. Where: United States.
• FlightAware: flight status. Data: flight numbers and dates, never names. Where: United States.
• Cloudflare, in front of our hosting: carrying every visit to our pages, and our domain name and its DNS records, including each partner's email address. Data: your internet address, the pages you open and what you type into them. Where: its data centre nearest you.
• Anthropic (Claude): reading a booking email from an airline or travel site we haven't seen before. Data: a copy of that booking email's text, with the travellers' names, the booking reference, email addresses and phone numbers replaced with made-up ones. Where: United States.
• GitHub: keeping that same copy, with the personal details replaced, while we teach the service to read that kind of email. Data: the copy only. Where: United States.

Payments and pre-loaded rescue cards are made on each Underwriter's own Stripe and Airwallex accounts, so for a pass, Stripe and Airwallex work for the Underwriter named in its terms.

When a provider processes data outside the country where you live, contracts hold it to the standard the law there requires.

Services that receive no personal data

Arvo also uses these services. They never receive a traveller's name, email, phone number, booking reference or card details, so they aren't subprocessors.

• SerpApi (Google Flights): typical fares, to set a rescue card's limit. Sent: airports, a date, the cabin and how many travel.
• Duffel: typical fares, used only if SerpApi isn't available. Sent: the same as SerpApi.
• Amadeus: market fares, to check that a booking's fare is believable. Sent: airports, a date and the currency.
• Open-Meteo: weather forecasts for airports. Sent: an airport's location.

Fonts are served by Arvo itself, so no font service sees your visit.

Changes

We tell each Underwriter before adding or replacing a provider, and record the change here with its date.

• 3 November 2026: the database moves from Render to Amazon Web Services; DNS moves from GoDaddy to Cloudflare.
• 29 October 2026: Amazon Web Services added, for each pass's record and our emails.
• 20 October 2026: Meta, Cloudflare and GitHub added; payments and cards are on each Underwriter's own accounts.
• 20 October 2026: services that receive no personal data listed; Anthropic reads a copy with personal details replaced.
• 18 October 2026: list published.