1. What this page is
The companies below process personal data on our behalf, each only for its task. The privacy notice says why we process data and on what legal basis; this page says who helps us, what they receive and where they are. Two of them, OpenAI and Anthropic, do the work of the AI features: a request goes to the main one first and to the other only when the first refuses it before doing any work, so either AI provider may receive a request, and a request the first refused reaches both. The web search of “Find new people” uses only the main one.
2. In use today
Cloudflare: delivers our website and app, protects them from attacks and bots (including the Turnstile bot check), stores uploaded archives, download files and backups, and passes on e-mails sent to our addresses. It receives the network address and browser details of every visit, the network addresses we choose to block, the files you upload and download, and e-mails you send us. Where: a company based in the United States; its network is worldwide, and our files are stored in its EU storage. Status: in use.
Railway: runs our servers and our database. It receives everything in your account, as stored in our database. Where: a company based in the United States; our servers and our database are hosted in the Netherlands (EU). Status: in use.
Clerk: handles signing in and your sign-in security, including Clerk Protect, which reads signals from your device and browser to tell people from automated sign-ups. It receives your name, e-mail address, sign-in details and the device and browser signals its checks read. Where: a company based in the United States. Status: in use.
OpenAI: on paid plans, writes AI message drafts, replies and practice answers, places companies in industries, and searches the web for “Find new people”, when OpenAI is the main AI provider that is switched on; for everything but that search, also as the one that takes over when the other is busy or down. It receives only what the AI feature needs, as the privacy notice and the AI notice say, and a code that stands for your account. Where: a company based in the United States. Status: in use.
Anthropic: on paid plans, writes AI message drafts, replies and practice answers, places companies in industries, and searches the web for “Find new people”, when Anthropic is the main AI provider that is switched on; for everything but that search, also as the one that takes over when the other is busy or down; and, whichever provider places a company, it checks every answer of the company scan a second time. It receives only what the AI feature needs, as the privacy notice and the AI notice say. Where: a company based in the United States. Status: in use.
Stripe: takes payments for paid plans, on its own payment page. It receives your card details, name, e-mail address and billing address (entered on Stripe's page), and our numbers for your plan. Where: a payments company with offices in the EU and the United States. Status: in use.
Resend: sends the e-mails you choose to get and the notices about your account, and the replies we write from our addresses. It receives your e-mail address and the e-mail itself. Where: a company based in the United States; our sending domain is set up in its EU region. Status: in use.
The provider of our mailbox: keeps the mailbox where e-mails sent to our addresses arrive (Cloudflare passes them on) and are read and answered. It receives the e-mails you send us, with what you write in them. Where: an e-mail provider that may keep e-mails outside the EU, under its own terms. Status: in use.
3. Others who may receive data
Stripe also uses some payment data for its own purposes, such as preventing fraud, under its own privacy notice. If you sign in with Google, Google learns that you signed in to TapForNetwork, under its own privacy notice. Our accountant, tax authorities, our lawyers and insurers, courts and authorities receive data only when the law or a legal claim needs it.
4. Transfers outside the EU
Where a company is based outside the EU, data can be sent to or reached from that country.
The European Commission has decided that companies in the United States that are certified under the EU–US Data Privacy Framework protect personal data adequately. A transfer to a company that is not certified needs another safeguard that the law accepts, such as the European Commission's standard contractual clauses.
You can ask us which safeguard covers a transfer, and for a copy of it, by writing to privacy@tapfornetwork.com.
5. Changes to this list
We update this page and the privacy notice before a new company receives personal data, and when a company's task changes. Business customers who sign our data processing addendum are told in advance, as the addendum says.
What changed in this version
- Says that the AI providers also place companies in industries, write replies and, as the main provider, search the web for “Find new people”.
- Says that Cloudflare also receives the network addresses we choose to block.
- Says that e-mails sent to our addresses arrive in the mailbox of our e-mail provider, to which Cloudflare passes them on.