Legal
Subprocessor List
This list identifies the third-party sub-processors Infotech Solutions engages to provide Tamanor, as referenced in our DPA and Privacy Policy. Each is engaged under a written contract imposing data-protection obligations equivalent to those we owe our Customers, and, where relevant, an approved international-transfer mechanism (see the International Transfers Notice). > Maintenance note: This is the authoritative list at the version date above. Some services are activated only when configured/enabled by the Operator or the Customer; until then no data flows to them. The Operator confirms and keeps this list current and gives at least 30 days' notice before adding or replacing a sub-processor.
Last updated: 17 July 2026
1. Infrastructure & operations
| Sub-processor | Service | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Vercel Inc. | Application hosting / delivery (Next.js) | Account, usage and log data; request metadata | USA (EEA edge) | DPF and/or SCCs + TIA |
| Managed PostgreSQL provider (to be confirmed by Operator, e.g. Vercel Postgres / Neon / Supabase) | Primary database | All controller and Customer Personal Data | EEA (preferred region) | EEA hosting; SCCs if outside EEA |
| Upstash, Inc. | Shared-store rate limiting (Redis/KV) — when enabled | Ephemeral request identifiers/counters | EEA/USA (region-selectable) | SCCs + TIA where US |
2. Communications
| Sub-processor | Service | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Google Ireland Ltd. / Google LLC (Google Workspace, Gmail API) | Transactional e-mail delivery (verification, password reset, service notices) | Recipient e-mail address, message metadata | EU/USA | DPF and/or SCCs + TIA |
3. Payments
| Sub-processor | Service | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Subscription billing & payment processing | Billing name/e-mail, country, VAT ID, payment status; card data collected directly by Stripe | EU/USA | DPF and/or SCCs + TIA |
4. AI classification (optional — Customer-enabled)
| Sub-processor | Service | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| External AI risk provider (only if the Customer enables an external provider; none is wired by default) | AI risk classification of public content | Public content text + limited author metadata | Per provider | SCCs + TIA / DPF as applicable |
By default, classification runs on our own rules/engine and no external AI provider receives data.
5. Analytics & marketing (consent-gated — website only)
| Sub-processor | Service | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Google Ireland Ltd. / Google LLC (Google Analytics 4, Google Ads) | Website analytics & conversion measurement — only after consent | Online identifiers, usage events | EU/USA | DPF and/or SCCs + TIA |
| Meta Platforms Ireland Ltd. (Meta Pixel) | Campaign measurement — only after consent | Online identifiers, event data | EU/USA | DPF and/or SCCs + TIA |
These load only where the visitor has consented and are never active in preview/development environments.
6. Platform connectors (not sub-processors)
The platforms you connect (Meta/Facebook & Instagram, Google/YouTube, LinkedIn, TikTok, Google Business Profile) are independent controllers/sources accessed via official OAuth. They are not our sub-processors; your use of them is governed by their own terms and by the authorisation you grant.
7. Contact
Questions or sub-processor objections: info@tamanor.com.