Service providers we use
These are the companies that process personal information on behalf of Mysite.ai, Inc. (“Tasted”, “we”) to run the Tasted app, our servers, and this website. For each one, the table below says what it does for us, which personal information it handles, where it handles it when we know, and links to the data processing terms it publishes. Our Privacy Policy is the full account of what we collect and why.
The short version
- The table lists what each provider handles for us. Your sign-in code goes only to Telnyx, which delivers it, and no provider receives a card number — we never have one.
- Most of these providers’ terms include the EU Standard Contractual Clauses, with the UK Addendum, for personal information that leaves the EEA or the UK. Where a provider relies on something else first, the table says so.
- We will update this list before adding a new provider that processes personal data.
- Two of these providers hold the phone number of somebody who does not use Tasted, if a user invited that number: Telnyx to deliver our one invitation and any messages that person asked for, and Customer.io to decide and send those — nothing is sent to that number on Customer.io’s side until its owner asks for it. See If somebody invites you by phone number, which says on what basis and how to have it erased.
- To ask about any of this, or to exercise a privacy right, see Making a privacy request or email privacy@jointasted.com.
The list
“Where” is the region we use with that provider where we have been able to confirm it. Where we have not, it says “see provider”, and the provider’s own terms say where it may process data.
| Provider | What it does for us | Personal information it handles | Where | Data processing terms |
|---|---|---|---|---|
| Amazon Web Services | Hosting for our servers, our database and file storage, and sign-in (Amazon Cognito). | What the Service stores about you, as for Supabase below; your phone number and your sign-in sessions; and requests passing through our servers, with the technical information that comes with them, such as IP addresses. | See provider | AWS Data Processing Addendum |
| Supabase | Our database and file storage. | What the Service stores about you: your account and profile, posts, photos and receipt images, Tasted Cash records, and contacts you choose to share. | United States | Supabase Data Processing Addendum Includes the EU Standard Contractual Clauses and the UK Addendum. |
| Vercel | Hosting for our servers and this website. | Requests passing through our servers, and the technical information that comes with them, such as IP addresses. | United States | Vercel Data Processing Addendum Includes the EU Standard Contractual Clauses and the UK Addendum. |
| Telnyx | Sending text messages: your sign-in code; the one invitation from us a person you tag or invite by phone number may receive; and messages to a person who asked for them. | The phone number a message goes to and the message itself. An invitation says who tagged or invited the person and at which restaurant. | See provider. A text message is delivered through the recipient’s mobile network, in their country. | Telnyx Data Processing Addendum Includes the EU Standard Contractual Clauses and the UK Addendum. |
| RudderStack | Collecting usage and account events, and passing them to Customer.io. | Usage events linked to a random identifier, basic device information, and the details listed for Customer.io below, on their way there. | United States | RudderStack Data Processing Addendum Includes the EU Standard Contractual Clauses and the UK Addendum. |
| Customer.io | Sending push notifications and other messages to you — and messages to a phone number that has no Tasted account, once its owner has asked for them on the invitation’s page. | Your phone number, first name, city, the date you joined, your notification settings, whether you have a Tasted Card or a submission in progress, your device’s push token, the IP address you were last seen at and the approximate location derived from it, and which ad, campaign, or link brought you to Tasted. Never a receipt total, your balance, or your contacts. For an invited number with no account: that phone number, and the state of the invitation — sent, opened, accepted or declined, and when. No name, because an invitation never asks for one. See If somebody invites you by phone number. | United States | Customer.io Data Processing Addendum Includes the EU Standard Contractual Clauses and the UK Addendum. |
| AppsFlyer | Measuring which of our ads, campaigns, or links brought you to Tasted. | An identifier it assigns to the app on your phone, your account’s random identifier, the device information and IP address its software reports, and a few milestones in the app, such as signing up or publishing a post. Never your phone number, your name, your device’s advertising identifier, or an amount. See Advertising and install measurement. | See provider | AppsFlyer Data Processing Addendum |
| Intercom | The support conversations you start from the app. | What you write and attach, including a video with sound if you choose to record one, basic device information (device model, operating system, app version, and an approximate location from your IP address), and, if you are signed in, your account’s random identifier. Never your phone number, a receipt total or your balance. | See provider | Intercom Data Processing Agreement Relies on the EU–US Data Privacy Framework and its UK Extension, and on the EU Standard Contractual Clauses with the UK Addendum where those do not apply. |
| Sentry | Error reporting from our servers. | Technical details of errors on our servers. The app itself sends nothing to Sentry. | See provider | Sentry Data Processing Addendum Relies on the EU–US Data Privacy Framework and its UK Extension, and on the EU Standard Contractual Clauses with the UK Addendum where those do not apply. |
| logo.dev | The university logos shown in the app. | The app loads each logo directly from logo.dev, so it receives your device’s IP address and which university’s logo was requested — nothing about your account. | Primarily the United States | logo.dev Data Processing Agreement Includes the EU Standard Contractual Clauses, which logo.dev says cover transfers from the EEA, the UK and Switzerland. |
Google Places works differently
We use Google Places for restaurant information and to find restaurants near the area of the map you are looking at. Those searches go from our servers to Google, not from your phone, and we do not send Google your name, phone number, or account. The map itself is Google’s Maps SDK in the app, which, as Google declares for it, sends Google how the map performs, crash reports, and an identifier for the app on your device.
Google is not our service provider for this. Under the Google Maps Platform Terms, Google handles these requests as an independent controller, under the Google Controller-Controller Data Protection Terms and Google’s own privacy policy. For personal information leaving the EEA or the UK, those terms rely on the EU–US Data Privacy Framework and its UK Extension, and otherwise on controller-to-controller Standard Contractual Clauses.
Who is not on this list, and why
- TBO Bank, mCards, Inc. and Mastercard, for the Tasted Card. They are independent parties with their own legal obligations and their own privacy notices, not our service providers — see section 2 of the Privacy Policy. The Tasted Card is not available yet.
- Apple and Google, when you add a Tasted Card to Apple Pay or Google Pay. That is between you and them.
- Advertising networks, such as Meta, Google, TikTok, or Apple Search Ads, which AppsFlyer may tell that an install or a milestone came from their ad. They are not our service providers — see Advertising and install measurement.
- Plaid, when you link a bank account as your Tasted Card’s backup payment. See section 3 of the Privacy Policy.
Changes to this list
We will update this list before adding a new provider that processes personal data, and change the date at the top of this page when we do. If a change is material, our Privacy Policy says how we will tell you.
Questions and copies
You can ask us for a copy of the safeguards that apply to a transfer, or anything else about these providers, at privacy@jointasted.com. To see, correct, delete, or move your information, see Making a privacy request.
Mysite.ai, Inc.
21 Miller Alley, Suite 210
Pasadena, CA 91103
United States