Sub-processors
This page lists the third parties that process personal data on behalf of Tonecast, whether it is Customer Personal Data we process for our customers under the Data Processing Addendum or data we control as described in the Privacy Policy. It forms Annex III of the DPA.
1. Current sub-processors
| Name | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| Hetzner Online GmbH | Cloud infrastructure: application servers, database, file storage and backups | All Customer Data, Account Data and logs | Germany (EU) | Not applicable (processing in the EU) |
| OpenAI | Sampling answers to customer prompts (ChatGPT models); model-assisted analysis steps | Prompts and related campaign inputs (for example subject names, fact-sheet content); no Account Data | USA | EU-US Data Privacy Framework where certified, otherwise SCCs; UK Addendum |
| Anthropic | Sampling answers to customer prompts (Claude models); model-assisted analysis steps | Prompts and related campaign inputs; no Account Data | USA | EU-US Data Privacy Framework where certified, otherwise SCCs; UK Addendum |
| Google (Gemini API) | Sampling answers to customer prompts (Gemini models); model-assisted analysis steps | Prompts and related campaign inputs; no Account Data | USA / global | EU-US Data Privacy Framework where certified, otherwise SCCs; UK Addendum |
| Perplexity | Sampling answers to customer prompts, with their citations | Prompts and related campaign inputs; no Account Data | USA | EU-US Data Privacy Framework where certified, otherwise SCCs; UK Addendum |
| DataForSEO OÜ (Estonia) | Search results and AI-generated search results (such as Google AI Overviews) for campaign queries | Search queries derived from prompts and subject names; no Account Data. DataForSEO keeps the tasks it runs for 365 days | Estonia (EU); its infrastructure providers are in Germany (EU) and the USA | Not applicable to the transfer to Estonia (EU). DataForSEO's own transfers to processors in third countries rely on SCCs or adequacy decisions, under its Data Processing Agreement |
| Brave Search | Web search results used to discover sources | Search queries derived from prompts and subject names; no Account Data | USA | EU-US Data Privacy Framework where certified, otherwise SCCs; UK Addendum |
| Stripe | Payments, subscription billing, tax calculation, invoices and customer portal | Billing data: company name, address, VAT number, billing e-mail, payment details | USA / Ireland | EU-US Data Privacy Framework where certified, otherwise SCCs; UK Addendum |
| Brevo (Sendinblue SAS) | Sending service e-mails: verification, invitations, notices and alerts; the free check result, only to an address given with its consent | E-mail addresses, names where given, message content | EU | Not applicable (processing in the EU) |
| Cloudflare, Inc. | DNS for our domain; receiving and forwarding e-mails sent to our addresses; Turnstile, which tells people from bots on the free AI visibility check | E-mails people send us: addresses, names where given, message content; for Turnstile, the technical data its widget collects in the visitor's browser (IP address, browser and device signals) | USA and global network | EU-US Data Privacy Framework where certified, otherwise SCCs; UK Addendum |
| Sentry (Functional Software, Inc.) | Error monitoring | Technical error data, which may incidentally include user identifiers or IP addresses | EU (Germany data region); company in the USA | EU-US Data Privacy Framework where certified, otherwise SCCs; UK Addendum |
"SCCs" means the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914; "UK Addendum" means the UK International Data Transfer Addendum to those clauses. Details are in Section 11 of the DPA.
2. Services that are not sub-processors
Availability monitoring. UptimeRobot checks every few minutes that the public site and the API answer. It requests public pages only and processes no Customer Data or Account Data.
Open data sources. To build source graphs, our service requests public content from the Reddit API, the YouTube Data API, Wikipedia and Wikidata, RSS and news feeds, and publicly accessible websites. These requests may contain the name of a campaign's subject, but these services do not process Customer Data on our behalf and are not sub-processors.
Website fonts. Our website loads fonts from Google Fonts (Google, USA). When a page loads, your browser sends your IP address and browser information to Google. No cookies are set for this purpose.
3. Changes to this list
We give at least 30 days' notice before a new or replacement sub-processor starts processing Customer Personal Data: we update this page and inform the owners of each customer Organization by e-mail or in the Service. Customers can object as described in Section 6 of the DPA. Anyone else who wants to be notified of changes can write to privacy@tonecast.io.
4. Contact
TonecastVia dei Compositori 85, 00128 Rome, Italy
VAT number: IT18201491000
General contact: support@tonecast.io
Privacy contact: privacy@tonecast.io