Sub-processors
This page lists the third parties that process personal data on behalf of Tonecast, whether it is Customer Personal Data we process for our customers under the Data Processing Addendum or data we control as described in the Privacy Policy. It forms Annex III of the DPA.
1. Current sub-processors
| Name | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| Hetzner Online GmbH | Cloud infrastructure: application servers, database, file storage and backups | All Customer Data, Account Data and logs | Germany (EU) | Not applicable (processing in the EU) |
| OpenAI | Sampling answers to customer prompts (ChatGPT models); model-assisted analysis steps | Prompts and related campaign inputs (for example subject names, fact-sheet content); no Account Data | USA | EU-US Data Privacy Framework where certified, otherwise SCCs; UK Addendum |
| Anthropic | Sampling answers to customer prompts (Claude models); model-assisted analysis steps | Prompts and related campaign inputs; no Account Data | USA | EU-US Data Privacy Framework where certified, otherwise SCCs; UK Addendum |
| Google (Gemini API) | Sampling answers to customer prompts (Gemini models); model-assisted analysis steps | Prompts and related campaign inputs; no Account Data | USA / global | EU-US Data Privacy Framework where certified, otherwise SCCs; UK Addendum |
| Perplexity | Sampling answers to customer prompts, with their citations | Prompts and related campaign inputs; no Account Data | USA | EU-US Data Privacy Framework where certified, otherwise SCCs; UK Addendum |
| DataForSEO | Search results and AI-generated search results (such as Google AI Overviews) for campaign queries | Search queries derived from prompts and subject names; no Account Data | See provider | Adequacy or SCCs, depending on the processing location (see provider) |
| Brave Search | Web search results used to discover sources | Search queries derived from prompts and subject names; no Account Data | USA | EU-US Data Privacy Framework where certified, otherwise SCCs; UK Addendum |
| Stripe | Payments, subscription billing, tax calculation, invoices and customer portal | Billing data: company name, address, VAT number, billing e-mail, payment details | USA / Ireland | EU-US Data Privacy Framework where certified, otherwise SCCs; UK Addendum |
| Brevo (Sendinblue SAS) | Sending service e-mails: verification, invitations, notices and alerts | E-mail addresses, names where given, message content | EU | Not applicable (processing in the EU) |
| Cloudflare, Inc. | DNS for our domain; receiving and forwarding e-mails sent to our addresses | E-mails people send us: addresses, names where given, message content | USA and global network | EU-US Data Privacy Framework where certified, otherwise SCCs; UK Addendum |
| Sentry (only if enabled) | Error monitoring | Technical error data, which may incidentally include user identifiers or IP addresses | USA | EU-US Data Privacy Framework where certified, otherwise SCCs; UK Addendum |
"SCCs" means the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914; "UK Addendum" means the UK International Data Transfer Addendum to those clauses. Details are in Section 11 of the DPA.
2. Services that are not sub-processors
Open data sources. To build source graphs, our service requests public content from the Reddit API, the YouTube Data API, Wikipedia and Wikidata, RSS and news feeds, and publicly accessible websites. These requests may contain the name of a campaign's subject, but these services do not process Customer Data on our behalf and are not sub-processors.
Website fonts. Our website loads fonts from Google Fonts (Google, USA). When a page loads, your browser sends your IP address and browser information to Google. No cookies are set for this purpose.
3. Changes to this list
We give at least 30 days' notice before a new or replacement sub-processor starts processing Customer Personal Data: we update this page and inform the owners of each customer Organization by e-mail or in the Service. Customers can object as described in Section 6 of the DPA. Anyone else who wants to be notified of changes can write to privacy@tonecast.io.
4. Contact
TonecastVia dei Compositori 85, 00128 Rome, Italy
VAT number: IT18201491000
General contact: support@tonecast.io
Privacy contact: privacy@tonecast.io