Tech Ale OÜ uses the following providers to run Galamento. Each processes personal data only on our instructions, under a data processing agreement. We share personal data with them to run the service; we never sell it or share it for targeted advertising. We will update this page before adding a new provider that processes personal data.
| Provider | What they do for us | Personal data involved | Where | Safeguards |
|---|---|---|---|---|
| Cloudflare, Inc. | Hosting of the website and app, database, photo and video storage, background jobs, and automatic photo analysis (Workers AI) | Photos, first names, tags, organiser email, IP addresses | Global network; photos and database: Western Europe (Cloudflare location hint weur) | Data processing addendum, standard contractual clauses |
| Amazon Web Services, Inc. | Rendering the final videos (AWS Lambda) | Photos and first names in a season's video, for the duration of a render | AWS region eu-central-1 (Frankfurt, Germany) | AWS data processing addendum, standard contractual clauses |
| Resend (Plus Five Five, Inc.) | Sending emails: sign-in links, reminders, video ready, retention warnings | Email addresses, team name, first names in reminder emails | eu-west-1 (Ireland) | Data processing addendum, standard contractual clauses |
| Functional Software, Inc. (Sentry) | Error monitoring, with personal data scrubbed; reports kept up to 30 days | Technical error details, IP address (not stored) | European Union (Frankfurt, Germany) | Data processing addendum, standard contractual clauses |
| PostHog, Inc. | Privacy-friendly product analytics, where allowed; kept up to 1 year | Pseudonymous usage events, no photos, names or free text | EU Cloud (Frankfurt, Germany) | Data processing addendum, standard contractual clauses |
Google (Google Ireland Limited in the European Economic Area and Switzerland, Google LLC elsewhere) is used only when an organiser chooses Continue with Google. Google confirms who is signing in and sends us the name, email address and whether Google has verified it; we keep only the email address and Google's account number for that sign-in, and no Google tokens. For the Google account Google is an independent controller under its own privacy policy, not a sub-processor. Parents never sign in.
Paddle.com Market Ltd (United Kingdom) is our reseller and merchant of record: it runs checkout, payments, receipts, tax and refunds, and receives the buyer's name, email and billing details. For that payment data Paddle is an independent controller under its own privacy notice, not a sub-processor.
Questions about our providers: support@galamento.com.