These are the companies that process personal data on our behalf. Each is bound by a data processing agreement.
| Company | What for | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, database, storage, security, web analytics; AI processing (Workers AI): summaries, translation, screening | All service data | Global edge; primary storage EU and US |
| Stripe Payments Europe Ltd / Stripe, Inc. | Card payments; identity checks (Stripe Identity) for Tier 2 | Requester payment details. For Tier 2: heads' ID images, selfie and the details read from the ID, which 50heads asks Stripe to delete when the check ends; the biometric identifiers made from them, kept by Stripe for no longer than one year to detect fraud | Ireland, United States |
| Wise Payments Ltd | Bank transfers in; payouts to heads' bank accounts (UK, US, EU, Canada and other countries), which Wise holds so we never store full account numbers | Names, bank details, amounts | United Kingdom, EU |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Payouts to heads' PayPal accounts, and to Venmo accounts for heads in the US (through PayPal, Inc.) | Names, PayPal email, Venmo mobile number, amounts | Luxembourg, United States |
| Resend, Inc. | Sending email | Email addresses, email content | United States |
| Twilio Inc. | Text and WhatsApp codes | Phone numbers | United States |
| Google LLC | Sign in with Google; Play Integrity attestation; push notifications on Android | Account identifiers, device attestations, push tokens | United States |
| Apple Inc. | Sign in with Apple; App Attest; push notifications on iPhone | Account identifiers, device attestations, push tokens | United States |
| Functional Software, Inc. (Sentry) | Error monitoring, with personal data scrubbed | Technical logs | United States, EU |
| Expo (650 Industries, Inc.) | App builds and updates | Device and app identifiers | United States |
Changes
We give at least 30 days' notice before adding a subprocessor that handles personal data. We email every account holder with the details: who it is, what it does, which data, where, how transfers are protected and the date it takes effect. The email goes to every account, whatever its email settings. We also write when we remove a subprocessor or change how one is used, and if we withdraw a change we say so.
Upcoming changes and the history of past ones are listed below, and are available as JSON at /v1/public/subprocessors. To object, use the contact form before the date the change takes effect.
If you are a company contact without a 50heads account, we cannot email you automatically. Use the contact form with the subject "Subprocessor updates", and we'll add you to a list.