Services we use (sub-processors)
Version eu-2026-10-v1 · last checked 24 October 2026
These companies handle personal data for TapStik when TapStik runs the service for a café. We tell cafés at least 30 days before we add or replace one.
| Company | What it does | Where | How the transfer is covered |
|---|---|---|---|
| Vercel Inc. | Runs the app and stores the data (database file and uploaded pictures). | United States | EU–US Data Privacy Framework (Vercel is certified). |
| Resend, Inc. | Sends our emails: sign-in links, card links, reminders, and offers a café has switched on. | United States | EU–US Data Privacy Framework (Resend is certified); its agreement includes the EU Standard Contractual Clauses. |
| Only if a customer chooses “Continue with Google”: Google confirms their name, email address and Google account ID to us. Nothing else is shared. | Depends on Google | Google’s own terms; we do not send Google any customer data. |
Other things to know
- WhatsApp messages are sent by the café itself, from its own phone, one customer at a time. WhatsApp is not our sub-processor.
- TapStik's own team works from Indonesia and can reach the data there, for support and backups. The Data Processing Agreement covers this with the EU Standard Contractual Clauses.
- The domain name provider does not receive any customer data.