Subprocessor List

1) Introduction and scope

This document discloses Subprocessors used by Tanqory when acting as Processor for customers/controllers in all regions.
Use with the DPA, ROPA, Security Standards, Data Transfer Appendix, and Privacy Policy; if conflicts arise, the stricter/more specific or most stringent law applies.
Covers all Subprocessors handling personal data of customers/users/visitors and related technical data.
States cross-border transfers, transfer mechanisms (SCC/IDTA/BCR/adequacy), data types, and processing purposes.
Material changes will be notified via email/dashboard (durable medium) at least 30 days before effect, unless urgent for safety/legal reasons.
Objection rights per the DPA are honored; see Section 9.
This is Public for transparency and GDPR Art.28(2)-(4) and PDPA SG Section 26 compliance.
Continuing service after notice implies acceptance of the announced Subprocessors unless an objection and alternative are agreed.
Updated at least quarterly or on material changes (add/change/remove Subprocessor or destination country).
Contacts: legal@tanqory.com, dpo@tanqory.com, security@tanqory.com.

2) Definitions and roles

Subprocessor: entity engaged by Tanqory to process personal data on behalf of customers under the DPA/Order Form.
Controller: customer/merchant setting purposes/methods; Tanqory acts as Processor.
Processor: Tanqory (and affiliates) following Controller instructions and applicable law.
International Transfer: sending data outside EEA/UK/SG or equivalent regimes using SCC/UK IDTA/BCR or adequacy/consent.
Change Notification: advance notice of add/change/remove Subprocessor at least 30 days unless emergency.
Right to Object: customer’s right to reasonably object to a new Subprocessor per Section 9.
Durable Medium: email/dashboard/downloadable document retained per EU/UK transparency norms.
Sensitive Data: Art.9/10-equivalent data requiring extra safeguards and potentially limited to approved Subprocessors.
PCI Scope: payment-related use with PCI DSS-compliant providers; no CVV/track/full PAN sent.
AI/ADM: third-party AI services, if used, will be listed with purpose/data/measures per AI/ADM policy.

3) Subprocessor use policy

Select Subprocessors based on technical/organizational security, legal compliance, and reliability; include contract/standard reviews (ISO/SOC2/PCI, etc.).
Execute DPA/SCC/IDTA or equivalent with duties to delete/return data, maintain confidentiality, breach notification, purpose limitation, and audit/inquiry rights.
Minimize data shared and define purposes for each Subprocessor.
Apply cross-border mechanisms (SCC/IDTA/BCR/adequacy) and conduct DTIA/TRA where destination lacks adequacy.
Set breach notification SLAs and cooperation for investigation/mitigation to meet law (e.g., GDPR 72h, PDPA SG 3 days if notifiable).
Review risk and performance at least annually or after incidents/audit findings.
Subprocessors must not use data for their own purposes/marketing/model training unless expressly authorized and lawful.
Sub-subprocessors must be approved and bound to equivalent measures.
Replace/terminate Subprocessors that fail standards/high risk and notify customers per process.
Subprocessor records are kept in ROPA/DPA appendices and updated regularly.

4) Current Subprocessor snapshot

This table reflects the Subprocessors currently engaged by Tanqory. Live updates are mirrored on https://legal.tanqory.com/legal/data-protection/subprocessor-list.

Infrastructure

Payments

AI / ML

Lead capture / CRM

Disclosed 26 September 2026 — both integrations were already live in code and should have been listed sooner; these entries correct that rather than backdating them. Each connection only sends data when its own server credential is configured; whether that credential is currently set in the live environment was not confirmed at the time of this disclosure. They are listed here because the connection can send this data, not because live sending is confirmed — the same standard this list applies to the advertising destinations below. HubSpot: the owner has decided to remove this integration (see the version history); Slack is an internal-notification use only and stays.

Analytics & telemetry

Advertising conversion destinations (independent controllers, not Subprocessors)

An advertising platform that receives a conversion event does not process it only on Tanqory's instructions. It uses the event, alongside its own data, to run and improve its own advertising and measurement systems, and it decides for itself how it handles what it receives. These platforms are therefore disclosed here as recipients and independent controllers, not as Subprocessors, and the change-notification and objection rights in sections 8 and 9 do not apply to them.

Tanqory's servers are built to send conversion events to the platforms below (see the Cookie Policy, "Server-Side Conversion Sharing"). This table describes what the connection can send. It is not a statement that any platform is receiving data today; sending is controlled by a company-level switch, and this list is updated before any platform is turned on. Sending happens only with the person's advertising consent (both "ad user data" and "ad personalization"), never after a Global Privacy Control, Do Not Track or Do Not Sell/Share signal, and never for an erased account. Phone numbers are never sent.

Note on Meta account registration: Tanqory's Meta Business Portfolio (used for the Meta Conversions API connection above) remains verified on Meta's own systems under Tanqory's Singapore holding entity, TANQORY PTE. LTD., because Meta does not allow an already-verified business portfolio to change its verified entity and Tanqory's portfolio limit blocks creating a new one. This is a fact about how Meta's own account-verification system is configured, not a statement about who Tanqory contracts with: the Tanqory entity you deal with as a merchant or end user, and Tanqory's marketing sender identity, are unaffected and remain Tanqory Inc.

Authentication / identity providers

Content sourcing (stock imagery — mobile app)

Communications

Observability & security

Productivity / real-time

Domain registrar (an independent controller, not a Subprocessor)

A domain registrar does not process registration data on Tanqory's instructions. It collects, verifies, publishes and discloses that data under its own obligations to ICANN and to the registry for each top-level domain, and it decides disclosure requests itself. The registrar is therefore disclosed here as a recipient and an independent controller, not as a Subprocessor, and the change-notification and objection rights in sections 8 and 9 do not apply to it.

Internal infrastructure (not external Subprocessors but disclosed for transparency)

Material updates to this list are notified per Section 8. The authoritative live list and any objection workflow is available at https://legal.tanqory.com/legal/data-protection/subprocessor-list.

5) Subprocessors by category

Infrastructure (cloud/hosting/CDN/database): DigitalOcean (primary compute + managed databases), Cloudflare (global edge + R2), AWS (S3 + multi-region pods), Google Cloud Platform (multi-region pods), MongoDB Atlas (AI vector + document storage). Region-pinned to the merchant's business region; cross-region only with SCC + technical safeguards.

Payments: Stripe (platform billing + Stripe Connect for merchants), PayPal (platform + merchant), Braintree (merchant adapter). All providers are PCI-DSS-attested; Tanqory operates under SAQ-A with client-side tokenization — no cardholder data is stored on Tanqory infrastructure.

AI / ML: OpenAI (default LLM + embeddings + image generation), Anthropic (selectable LLM), DeepSeek (opt-in only — PRC transfer), Google Gemini (TTS in tanqory-voice + on-device Gemini Nano on Android), Apple Foundation Models (on-device only on iOS 26+), CopilotKit (managed in-product AI copilot — downstream LLMs separately listed), PhotoRoom (AI image background removal in the mobile app; user-supplied images are transmitted to PhotoRoom). Training opt-outs are enabled by default where the provider supports them. AI features are merchant-controlled; merchants may restrict which providers are used.

Analytics & telemetry: PostHog (product analytics), Google Analytics for Firebase (mobile app analytics), Google Ads on-device conversion measurement (mobile advertising attribution — subject to Apple App Tracking Transparency consent and use of IDFA/AAID). Grafana Cloud (observability) is internal infrastructure with no personal data — see the internal-infrastructure table.

Advertising conversion destinations (independent controllers, not Subprocessors): Meta, Google Ads, LinkedIn, TikTok and OpenAI (ChatGPT Ads) receive server-side conversion events, and an X connection is prepared but not connected. They are recipients acting as independent controllers; sections 8 and 9 do not apply to them. See section 4.

Authentication / identity: Sign in with Google, Sign in with Apple, and Facebook Login (Meta) for federated authentication; Google Maps Platform (Places API) for address autocomplete.

Content sourcing (mobile): Unsplash and Pexels stock-image APIs (primarily content/IP licensing relationships).

Communications: SendGrid (primary transactional email), Resend (secondary email transport), Vonage and Twilio (SMS delivery covering platform security messages such as MFA and login alerts, transactional/service SMS, and merchant messaging — messages that merchants on the Tanqory platform send to their own customers, with Tanqory as the technology provider and sender of record and the merchant responsible for obtaining consent; Twilio additionally handles telecom compliance registration with US carriers), Firebase Cloud Messaging (Android push), Apple Push Notification service (iOS push). Customer.io (marketing communications orchestration — lifecycle marketing email, marketing SMS, marketing push, in-product marketing messages; currently US region only — EU region in Frankfurt is planned and EU/UK data subjects will route there automatically once provisioned). Tanqory enforces a logical separation between transactional routes (SendGrid/Resend/Vonage/Twilio/FCM/APNs) and marketing routes (Customer.io); see Marketing Communications Compliance Policy §8 and the Messaging Terms.

Observability: Sentry (error tracking + performance monitoring across backend, frontend, mobile). Centralized engineering on-call covers production.

Productivity / real-time: Liveblocks (real-time collaboration features in admin + storefront), Canva (embedded design tools via OAuth integration).

Domain registrar (independent controller): Namecheap, Inc. is the ICANN-accredited registrar for domain names that merchants register through Tanqory. Registrant details are sent to Namecheap to register, renew, and transfer those domains. Where required, Namecheap as registrar provides registration data to the registry for each domain, ICANN, data escrow providers, and registration data services, under its own obligations to ICANN and the registry. Namecheap is not acting on Tanqory's instructions when it does so, which is why it is listed as an independent controller rather than a Subprocessor. See the Domain Services Addendum.

Internal — disclosed for transparency: Infisical (self-hosted at secrets.tanqory.com) provides secret management. It is operated by Tanqory and is in scope of Tanqory's own ISMS rather than being an external Subprocessor.

Not used: Tanqory does not currently use Datadog, Intercom, Zendesk, Algolia, Bugsnag, or Backblaze. If any of these are added in the future, this list will be updated and customers notified per Section 8.

6) Cross-border transfers

Use SCC/UK IDTA/BCR or adequacy; conduct DTIA/TRA for non-adequate destinations and add technical measures (encryption, exporter key control).
List destinations/mechanisms in the table and DPA Appendix D; announce new countries per Section 8.
No transfers to sanctioned/restricted regions (UN/EU/OFAC/UK/HK/SG, etc.) unless legally compelled and compliant.
Sensitive/PCI data restricted to compliant zones/providers only.
Enterprise customers may request data residency pinning (e.g., EU/SG/US) subject to provider capability/legal fit.
Record transfers in ROPA/DTIA for audit and regulator responses.
Backups must not move data to new zones without notice/appropriate measures.
Subprocessors must not onward-transfer to unauthorized third parties without equivalent mechanisms and authorization.
Foreign orders/requests are assessed under applicable law; customers will be informed where allowed.

7) Subprocessor assessment and approval

Security/Privacy/Legal conduct due diligence (standards, controls, law, DTIA/TRA if needed) before use.
Require DPA/SCC/IDTA or equivalent with deletion/return, breach notice, and audit/inquiry rights.
Minimize data, set data zones, encryption, and disable unnecessary telemetry before sending data.
Risk assessment by data type/volume/region/service (e.g., payments/AI/analytics) with extra controls as needed.
Record assessments/approvals in vendor management/ROPA and assign monitoring owners.
Annual reviews or after incidents/disputes/standard changes to adjust controls or exit.
Sub-subprocessors need approval and equivalent DPA measures.
Providers failing criteria will not be used or will be replaced; suitable alternatives sought.
Enterprise customers may request non-confidential assessment details under NDA.
Access to systems/data for assessment follows need-to-know and NDA.

8) Change notifications

Notify add/change/remove Subprocessors via email/dashboard (durable medium) at least 30 days prior, unless immediate safety/legal action required.
Notice will state: provider/entity name, country/data zone, purpose, data types, transfer mechanism, effective date, objection channel.
Update live list in dashboard and DPA appendices with change history.
Changes reducing burden or adding protection may take immediate effect with information notice.
Enterprise customers may opt for daily/weekly digests or webhook alerts (as available in dashboard).
Emergencies (security/sanctions) may require immediate replacement/termination; notice will follow ASAP.
All notices are retained for dispute/audit reference in encrypted, access-controlled systems.
Service use after the objection window implies acceptance unless an alternative is agreed.

9) Right to object

Customers may object to a new Subprocessor within 30 days of notice by emailing legal@tanqory.com or via dashboard (if supported) with reasonable grounds and DPA reference.
Tanqory will respond within 10 Business Days with options: alternative provider, segregate affected service, or allow termination of affected services without penalty (per contract).
If no alternative is feasible, customer may terminate affected services per contract terms.
Unreasonable/late objections may be rejected with reasons.
Service use after the objection window signals acceptance of that Subprocessor.
Customers with special requirements (sensitive/government data) should predefine allowed Subprocessors in the Order Form.
Tanqory will not use the objected Subprocessor until resolved under this process.
Legally mandated Subprocessors/orders will be communicated with options within legal bounds.
All objections are logged and retained per the Data Retention Policy.

10) Change history

11) Contact

Legal/objections: legal@tanqory.com
DPO/data rights: dpo@tanqory.com
Security/incidents: security@tanqory.com
Website: https://legal.tanqory.com/
Target intake ≤2 Business Days; updates per SLA in the DPA/related policies.