Sub-processors

This list names the service providers we engage to deliver Taddoo and that process personal data on our behalf. Data processing agreements are in place with all of them, covering instruction binding, confidentiality, security and deletion obligations. We review the list continuously and keep it up to date here.

Service providers engaged

• Supabase, database, file storage and sign-in. Processing in the EU (Ireland).
• Vercel, hosting and delivery of the web application plus cookieless, aggregated reach measurement. Global delivery, headquartered in the US. Standard Contractual Clauses.
• Inngest, scheduled and event-driven background processing. Headquartered in the US. Standard Contractual Clauses.
• Upstash, short-lived caching and rate limiting. Processing in the EU.
• OpenRouter and the downstream model providers Anthropic, OpenAI and Google, AI models for extracting structured fields and drafting replies. Predominantly US. Standard Contractual Clauses. We use only API and business terms that exclude training on submitted data and route no data to providers that reserve a right to train.
• Google, connection of the Gmail mailbox, notification about new messages and sign-in with Google. Global, headquartered in the US. Standard Contractual Clauses.
• Apple, sign-in with Apple and delivery of push notifications to iOS devices. Global, headquartered in the US. Standard Contractual Clauses.
• Expo, technical delivery of push notifications to the artist app through the push services of Apple and Google. Headquartered in the US. Standard Contractual Clauses.
• Stripe, processing of subscription payments as well as deposits and in-person payments that studios collect through their own Stripe account. EU and US. For payment data Stripe is additionally an independent controller and its own privacy policy applies.
• Resend, sending of system emails and of campaign emails that a studio addresses to its own customers. Headquartered in the US. Standard Contractual Clauses.

Changes to the list

We announce a change or addition of sub-processors to studios by email with reasonable notice. You may object within 30 days on serious data protection grounds. If we cannot find a solution, you may terminate the agreement with effect from the date of the change. Questions and objections to hello@taddoo.com.