DRAFT — FOR LAWYER REVIEW. This document has not been reviewed by a qualified lawyer and is not yet binding on anyone. Points needing professional input are marked ⚑ lawyer inline. Do not launch against it.
Subprocessors
A subprocessor is a company we use that can, in the course of doing its job, see data belonging to people who use Tincograph. This page lists all of them. If a company is not on this page, it does not have access.
Current subprocessors
Supabase
- What it does
- The database, authentication and the functions that run our server-side logic. This is where accounts, settings and synced documents live.
- What it can see
- Email address, password hash, account settings, synced documents, usage records.
- Where
- European Union (eu-central-1, Frankfurt)
- Their privacy policy
- https://supabase.com/privacy
Cloudflare
- What it does
- Serves the website and the apps, and stores uploaded files in R2. Also provides the analytics described below.
- What it can see
- IP address (for the duration of a request), uploaded files, and the URL of each page view.
- Where
- Global edge network; R2 storage in the European Union
- Their privacy policy
- https://www.cloudflare.com/privacypolicy/
Resendnot yet connected
- What it does
- Sends transactional email — verification links, password resets, receipts. Not yet connected: no email is currently sent through anyone.
- What it can see
- Email address and the contents of the message sent to it.
- Where
- United States, under Standard Contractual Clauses
- Their privacy policy
- https://resend.com/legal/privacy-policy
Lemon Squeezynot yet connected
- What it does
- Takes payment as merchant of record, which means it — not us — charges you, issues the invoice and handles VAT. Not yet connected: nothing can be bought today.
- What it can see
- Email address, billing country, and the payment details you give it directly. We never see a card number.
- Where
- United States, under Standard Contractual Clauses
- Their privacy policy
- https://www.lemonsqueezy.com/privacy
Model providers
Tincograph does not currently send your prompts to any model provider on your behalf.
- Your own provider. If you add your own API key, requests go from your machine straight to that provider. We never see them, and that provider's terms are between you and them.
When we do add a hosted model, it will be listed above with the same four facts as everything else, and this page will change before the feature ships rather than after.
Analytics
Cloudflare Web Analytics is cookieless. It records the URL of a page view, a referrer and a coarse country, and it does not set an identifier or follow anyone between sites. That is why this site has no cookie banner: there is no consent to collect, because there is nothing to consent to.
Changes
Adding a subprocessor means changing this page. If you have a contract with us that requires notice before a change, notice goes to the address on that contract; otherwise the date above is the record. To be told when it changes, write to legal@tincograph.com.