Legal · Register
Who touches the data.
Every category of third party that processes customer data for the service, with what it does, which data reaches it, where it runs, and the basis for any transfer outside the EU. Each entry is checked against the code and configuration that call the service, not written from memory.
We publish categories rather than company names. Customers under the Data Processing Agreement can request the named list, and receive 30 days' notice on this page before a new category starts processing data.
Categories
- 01
Cloud hosting and backups
doesRuns the service — application servers, database, cache and logs — and keeps daily backups, with an encrypted copy off the primary servers.receivesEverything the service stores; each backup is a full copy of the database.whereEuropean UniontransferNone — processed and stored in the EU.statusin use - 02
Edge network: content delivery, TLS termination, DDoS protection and DNS
doesHandles the encrypted connection between your browser or server and us, in front of the site and the API; filters abusive traffic (it may set a security cookie to tell a browser from a bot); serves DNS.receivesIP addresses, request headers and request content while in transit.whereServers worldwide; the company is based in the United States.transferEU standard contractual clausesstatusin use - 03
Cookieless page analytics
doesCounts page views on the marketing site without cookies or cross-site identifiers.receivesIP address, browser type and page address, sent by a small script on the page.whereServers worldwide; the company is based in the United States.transferEU standard contractual clausesstatusin use — Not loaded on approval pages, the Telegram mini-app or signed-in application paths. - 04
Messaging platforms the user chooses: Telegram and WhatsApp
doesCarries verification, sign-in and approval conversations with the user’s own messaging app.receivesThe platform’s user identifier, the phone number where the platform shares it, and the messages exchanged with our bot.whereTelegram: operated by a company established outside the EU. WhatsApp: Meta’s EU entity for EU users.transferThese platforms are not our processors: the user starts the conversation from their own account, and each platform processes it as the user’s own service under its own terms; we send only the messages of that conversation. WhatsApp Business messaging runs under Meta’s EU terms.statusin use - 05
SMS carrier: inbound verification SMS and number lookup
doesReceives the SMS a user sends to prove a phone number and checks which carrier the number belongs to and whether it is a mobile, landline or internet (VoIP) number.receivesPhone number, the text of the SMS, the carrier and the number type.whereUnited StatestransferEU standard contractual clausesstatusin use - 06
Phone-number risk and carrier-data services
doesA second opinion on which carrier a number belongs to and whether it is a mobile, landline or internet (VoIP) number, and a risk score for the requesting IP address, to keep spoofed and virtual numbers out.receivesPhone number; the end user’s IP address for risk scoring.whereUnited StatestransferEU standard contractual clausesstatusin use — Switched on in production; it can be switched off per deployment, and when off no data is sent. - 07
Transactional email delivery
doesSends every email the service sends: sign-in codes and links, verification requests a customer asks us to send to its users, domain-ownership codes, reminders, alerts and account notices.receivesEmail address and the content of the email; if you send from your own domain, that domain name, registered with the provider for signing.whereUnited StatestransferEU standard contractual clausesstatusin use - 08
Public DNS resolvers and package registries queried for verification
doesWhen a business verifies a domain, we read that domain’s public DNS records through public DNS resolvers, the same lookup any browser makes to reach a website. When a published package is verified or watched, we read its public page on the package registry. We ask more than one resolver so that a single wrong answer cannot pass a check.receivesOnly the domain name or package name being checked, together with our own server’s address. No end-user data is sent: the person who asked for the verification is not identified in the lookup. A domain or package name can point to a person only when its owner chose to put their own name in it.whereThese are public internet services run from servers around the world; the nearest one answers.transferNone needed: there is no contract and no personal data of our customers’ users in the query — the name being checked is already public.statusin use - 09
Payment processing
doesTakes card payments and issues invoices for paid plans.receivesFrom us: your email address, display name and an internal account reference. From you: the name and billing address you enter at checkout. Card numbers never reach us; we receive only the payment status and the invoice.whereUnited StatestransferEU standard contractual clausesstatusin use — Used only when a paid plan or a balance top-up is bought; a free account sends nothing to this category.
Not on this list because no personal data reaches them: our own database, cache and log stores, which run on the hosting above; the logos and, on the main site and the dashboard, the typefaces, which are served from our own servers; the managed store that holds our own credentials, which holds no customer data; the uptime and source-control services we use, which receive no end-user data. Your own webhook endpoints and DNS providers are your destinations, not ours.
To object to a new category, write to [email protected] within the 30-day notice period; if we cannot find a solution, you may stop using the channel or feature that category serves, or end the agreement (DPA §6).
Every change to a row moves the review date above, and customers under the DPA receive the notice it describes. The categories, their purposes and the data they receive are also described in the Privacy Policy.