1. How to read this list
A subprocessor processes Customer Personal Data for taplyy to help provide the service. An independent platform may receive data because a customer or passholder chooses its product and generally determines its own platform processing. The distinction matters for contractual responsibility.
Infrastructure regions and provider affiliates may depend on the production configuration selected for a customer. Contact support@taplyy.com before onboarding if a specific hosting region or transfer restriction is required.
2. Vercel Inc.
Purpose: website and application hosting, content delivery, request processing, deployment infrastructure, operational logs, security, and monitoring.
Data may include: IP address, request and device metadata, diagnostic data, account or content data transmitted through hosted application functions, and security events.
Processing location: provider infrastructure and locations configured or used for the service, which may include the United States and other countries described by Vercel.
3. Supabase, Inc.
Purpose: hosted database, authentication, session management, storage, backend infrastructure, logs, and related security functions.
Data may include: workspace identity, account and authentication data, Customer Content, Customer Personal Data, pass and campaign records, usage events, and technical logs.
Processing location: the production project region selected by taplyy and locations used by Supabase and its infrastructure providers. The final production region will be documented before customer data is onboarded.
4. Providers not yet appointed
taplyy has not yet selected a payment processor. No payment provider is authorized as a subprocessor through this list. We will publish the provider, purpose, relevant data, and processing location before payment processing begins.
Product analytics and CRM are currently described as internally operated. If an external analytics, CRM, email, support, or monitoring provider is appointed and processes Customer Personal Data, this list will be updated before that processing begins.
5. Independent third-party platforms
Google LLC: Google sign-in and Google Wallet. Google receives authentication or wallet data under its own terms and privacy policy. For Google Wallet issuance, taplyy may operate as an authorized aggregator on behalf of a customer.
Apple Inc. and relevant affiliates: Apple Wallet and Apple Developer services. Apple processes wallet and developer data under its own terms and privacy policy. Production Apple passes must use the responsible customer's eligible Apple issuer identity under the approved taplyy model.
These platforms are disclosed for transparency but are not presented as taplyy subprocessors when they independently determine their platform processing.
6. Updates and objections
We will update this page when the list or provider purposes change. Customers may subscribe to updates by emailing support@taplyy.com with the subject 'Subprocessor updates'. Objections are handled under the Data Processing Addendum.