These are the companies that process personal data on our behalf. Each is bound by a data processing agreement.
| Company | What for | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, database, storage, security, web analytics | All service data | Global edge; primary storage EU and US |
| Stripe Payments Europe Ltd / Stripe, Inc. | Card payments; identity checks (Stripe Identity) for Tier 2 | Requester payment details; heads' ID and face images | Ireland, United States |
| Wise Payments Ltd | Bank transfers in; payouts to heads' bank accounts (UK, US, EU, Canada and other countries), which Wise holds so we never store full account numbers | Names, bank details, amounts | United Kingdom, EU |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Payouts to heads' PayPal accounts, and to Venmo accounts for heads in the US (through PayPal, Inc.) | Names, PayPal email, Venmo phone number, amounts | Luxembourg, United States |
| Resend, Inc. | Sending email | Email addresses, email content | United States |
| Twilio Inc. | Text and WhatsApp codes | Phone numbers | United States |
| Google LLC | Sign in with Google; Play Integrity attestation; push notifications on Android | Account identifiers, device attestations, push tokens | United States |
| Apple Inc. | Sign in with Apple; App Attest; push notifications on iPhone | Account identifiers, device attestations, push tokens | United States |
| Functional Software, Inc. (Sentry) | Error monitoring, with personal data scrubbed | Technical logs | United States, EU |
| Expo (650 Industries, Inc.) | App builds and updates | Device and app identifiers | United States |
Changes
We give at least 30 days' notice before adding a subprocessor that handles personal data. To be told of changes, use the contact form with the subject "Subprocessor updates", and we'll add you to the list.