Sub-processors
Every third party that processes data on our behalf, and what each one receives.
These policies are published in English. The English text is the authoritative version; translations are provided for convenience only.
Last updated: 2026-08-01
The registered company details for this service have not been published yet. They will appear here and in the footer as soon as they are confirmed.
These are the third parties that receive data as part of running ShelfTap. We notify account holders by email before adding a new sub-processor that handles personal data.
Product and infrastructure
| Sub-processor | Purpose | What it receives |
|---|---|---|
| [HOSTING PROVIDER AND REGION — TO BE SUPPLIED] | Virtual private server hosting the application and database | All application data at rest and in transit |
| Google LLC — Gemini API | Company classification, tag generation and the in-app assistant | Search terms, company names, and public page text collected for a search |
| Cloudflare, Inc. — Workers | Reverse proxy in front of the Gemini API | The same request payloads, in transit |
| xAI — Grok API (search backend) | Product profiling and company reasoning | Search terms and public page text |
| Serper.dev (search backend) | Web, maps and news search lookups | Generated search queries only |
Account, payment and communication
| Sub-processor | Purpose | What it receives |
|---|---|---|
| NOWPayments | Cryptocurrency checkout and payment status callbacks | Order id, amount, plan and the email address associated with the order |
| Google LLC — OAuth "Sign in with Google" | Optional social login | Your Google account identifier, name, email and profile picture URL, only if you choose it |
| Google LLC — reCAPTCHA v3 | Bot protection on public forms | Your IP address and interaction signals |
| Google LLC — Analytics | Usage measurement | Pseudonymous usage events — only if you accept analytics cookies |
| Google LLC — Gmail SMTP relay | Transactional email (verification, password reset, contact replies) | Recipient address and message content |
| Telegram Messenger | Internal operational alerts to the operators | Service health messages; no customer personal data is sent deliberately |
Static assets
Pages load fonts and icon CSS from Google Fonts, jsDelivr and cdnjs. Those providers see your IP address and user-agent as a consequence of serving the file. They receive no account data.