Avriloq
Data protection

Service providers & integrations

Avriloq distinguishes providers we appoint to operate the service from external systems a customer chooses to connect. The legal role follows the actual processing relationship, not the provider logo.

Last updated 18 August 2026

Jasper Whitehead trading as Avriloq, a UK sole trader. Service address: 28 Hilldown Road, Hemel Hempstead, Hertfordshire, HP1 3JD, United Kingdom.

A. Downstream service providers / subprocessors

These providers form part of Avriloq's operational service and may process Customer Personal Data on Avriloq's behalf when Avriloq acts as processor.

Lovable / Lovable Cloud

Official legal information
Purpose
Application platform, deployment/runtime, database and authentication infrastructure used to operate Avriloq.
Typical data
Application and Customer Personal Data required to host, authenticate, store and operate the configured Avriloq service.
Role summary
Downstream service provider/subprocessor where it processes Customer Personal Data for Avriloq. Lovable's own approved downstream infrastructure is governed through its DPA/subprocessor chain.

Resend

Official legal information
Purpose
Transactional invoice and reminder email, and related email processing where configured.
Typical data
Recipient email addresses, message content and delivery metadata required for the configured communication.
Role summary
Downstream service provider/subprocessor for transactional email data processed on Avriloq/customer instructions.

B. Customer-authorised external integrations

These services are connected by a customer for that customer's own business workflow. Their legal role can vary by product and provider terms, so they are not automatically classified as Avriloq subprocessors.

Stripe

Official legal information
Purpose
Avriloq subscription billing and customer-authorised connected invoice-payment services.
Typical data
Account, billing, connected-account, transaction and payment information required for the Stripe service being used.
Role summary
Customer-authorised payment service. Stripe's controller/processor role varies by product and data flow; it is not described here as a blanket Avriloq subprocessor.

Intuit / QuickBooks Online

Official legal information
Purpose
Customer-authorised accounting connection and import/synchronisation of supported accounting records.
Typical data
QuickBooks company identifiers and accounting/customer/invoice data within the scopes authorised by the connected customer.
Role summary
Customer-authorised external service governed by Intuit's platform and privacy terms. Avriloq accesses it only when a customer connects the integration.

Xero

Official legal information
Purpose
Customer-authorised accounting integration where enabled.
Typical data
Accounting, contact and transaction data within the scopes authorised by the connected customer.
Role summary
Customer-authorised external service governed by Xero's developer/platform and privacy terms; not automatically a Avriloq subprocessor.

Salesforce

Official legal information
Purpose
Customer-authorised CRM integration where enabled.
Typical data
CRM account/contact and related business data within the scopes authorised by the connected customer.
Role summary
Customer-authorised external service governed by Salesforce's applicable service/privacy terms; not automatically a Avriloq subprocessor.

Why the distinction matters

A subprocessor is appointed by Avriloq to help Avriloq deliver processor services. A customer-authorised external integration is a service the customer separately chooses to connect and instructs Avriloq to communicate with. Some providers may occupy different roles for different data flows. Avriloq therefore records the relevant purpose and role instead of applying one label to every third party.

Provider changes

Before introducing a new downstream provider that will materially process Customer Personal Data, Avriloq reviews the purpose, data required, security/privacy information, contractual protections and relevant international-transfer safeguards. Customers with a contractual subprocessor-change notice requirement can contact hello@billflowinvoicing.com to arrange the applicable notice process.

Customer-authorised integrations may be added, removed or changed as the product develops. Connecting one is optional unless the applicable Avriloq plan or order expressly states otherwise.

International processing

Some providers may process data outside the UK. Where UK data-protection law treats a Avriloq-controlled transfer as restricted, Avriloq assesses the relevant provider relationship and lawful transfer mechanism. A customer-authorised provider may separately be responsible for transfers it makes under its own terms.