Legal
Sub-processors
The third-party services that help us run the platform, and what data each one touches.
Effective Date: July 29, 2026
Last Updated: November 2, 2026
A Sub-processor is a third-party service we use to operate the Platform, like Stripe for payments or Supabase for our database. We share with each Sub-processor only the data needed for its specific purpose, and we require each one by contract to protect your data, use it only for the purposes we authorize, and meet applicable data protection law. This page is the canonical list referenced by Section 9.2 of our Privacy Policy at /legal/privacy.
When we add or remove a Sub-processor we update this page, and we notify users in the European Economic Area, the United Kingdom, and Switzerland at least thirty (30) days before a new Sub-processor begins processing their data, with an explanation of the right to object.
Current Sub-processors
| Sub-processor | Purpose | Data shared | Location | Privacy policy |
|---|---|---|---|---|
| Stripe, Inc. (including Stripe Identity)* | Payments, Connect platform payouts, Identity verification | Name, email, phone, payment instrument, government ID (for Identity), business info | US, EU, India | stripe.com/privacy |
| Supabase, Inc. | Database, authentication, file storage | All account and Platform data | US (AWS us-east-1) | supabase.com/privacy |
| Vercel, Inc. | Hosting, edge functions, scheduled tasks | Application logs, server-side request data | Global edge with US storage | vercel.com/legal/privacy-policy |
| Cloudflare, Inc. | DNS, edge caching, DDoS protection, promo video hosting (Cloudflare Stream) | IP addresses, request metadata, promo videos that artists and venues upload | Global edge, US headquarters | cloudflare.com/privacypolicy |
| Google LLC (YouTube) | Players for promo videos a page links; they load only after a tap | When a visitor taps play: the visitor's IP address and browser data, sent by the visitor's browser to YouTube's privacy-enhanced (youtube-nocookie.com) player. When an artist or venue adds a link, we ask YouTube for the video's title and thumbnail | Global | policies.google.com/privacy |
| Vimeo.com, Inc. | Players for promo videos a page links; they load only after a tap | When a visitor taps play: the visitor's IP address and browser data, sent by the visitor's browser to Vimeo's player (with Do Not Track on). When an artist or venue adds a link, we ask Vimeo for the video's title, length and thumbnail | US | vimeo.com/privacy |
| Mapbox, Inc. | Map display, geocoding | Venue addresses, IP for tile delivery | US (AWS) | mapbox.com/legal/privacy |
| Anthropic, PBC | Ask AI feature, content analysis, and Market Check web research | User queries to Ask AI, content submitted for AI analysis; for Market Check, a metro area and month only (never an artist name, venue or date being negotiated) | US | anthropic.com/legal/privacy |
| Google LLC (Gemini API) | AI image generation for marketing assets | Photos and prompts a workspace submits for asset generation | Global | policies.google.com/privacy |
| Resend, Inc. | Transactional email | Recipient email, message body and metadata | US | resend.com/legal/privacy-policy |
| Google LLC (Gmail SMTP) | Transactional email fallback during migration | Recipient email, message body and metadata | Global | policies.google.com/privacy |
| Twilio Inc. | Text messages people opt in to: account text alerts and Ticket buyers' show reminders (not active until our SMS program registration is approved) | Phone number, message content (including STOP and HELP replies) | US | twilio.com/en-us/legal/privacy |
| Meta Platforms, Inc. | Facebook Page admin OAuth for Artist verification; advertising measurement (Meta Pixel and Conversions API), always subject to the consent controls in Privacy Policy Section 11 | OAuth token scoped to Page admin status; with consent: pixel cookie identifiers (_fbp/_fbc), and on ticket purchase a SHA-256-hashed email and phone plus order value | US | facebook.com/privacy/policy |
| PostHog, Inc. | Product analytics, subject to the consent controls in Privacy Policy Section 11 | Usage events, pages viewed, device and browser info, account id and email once signed in | US | posthog.com/privacy |
| Functional Software, Inc. (Sentry) | Error monitoring | Error reports with request metadata; personal fields are scrubbed before sending | US | sentry.io/privacy |
| Spotify AB | Artist profile images and catalog lookups via the Spotify Web API | Artist names we search; no user Personal Information | EU (Sweden), US | spotify.com/legal/privacy-policy |
| Bandsintown Group Inc. | Reading an artist's own upcoming Bandsintown events, when the artist connects it, so they can review them on Dates | The artist's own Bandsintown API key and their Bandsintown artist id or artist name; nothing is sent back to Bandsintown | US | corp.bandsintown.com/privacy |
| Ticketmaster (Live Nation Entertainment, Inc.) | Public event listings used by Market Check to find concerts near a venue on a candidate date | Venue coordinates and a date range only; no Personal Information and no user, artist or booking identifiers | US | privacy.ticketmaster.com |
| Firecrawl | Fetching public web pages during partner onboarding | Public URLs we are asked to import; no account data | US | firecrawl.dev/privacy-policy |
| Apple Inc. | Sign in with Apple authentication | Apple-provided email, name on first signup only | US | apple.com/legal/privacy |
*Stripe Identity processes biometric data under Stripe's separate retention schedule (no longer than one year per Stripe Privacy Center, or upon revocation of your consent, whichever is earlier).
Questions or Objections
Email privacy@tourifik.com. Users in the European Economic Area, the United Kingdom, and Switzerland may object to a new Sub-processor within the thirty (30) day notice window; we will work with you in good faith on a resolution, which may include not applying the new Sub-processor to your data where technically feasible.