Who is who
For personal data your visitors submit to you through taproute or Popin (form entries on a hosted page or a Popin page, and similar), you are the controller and we are your processor. You decide why and how that data is collected; we only store and return it on your behalf.
This is different from the data described in our Privacy Policy, where we are the controller, for example your own account details. Payments are handled by Creem as merchant of record, and card details never reach us.
What we process for you
- Subject matter: running taproute and Popin for you and storing what your visitors submit.
- Duration: for as long as your account is open, then per the deletion terms below.
- Nature and purpose: storing, displaying back to you, and deleting on your instruction the entries collected through your pages and forms.
- Types of data: whatever your form asks for, typically a name, email or message. You control the fields, so you decide the categories.
- Categories of data subject: the visitors who submit your forms.
You must have a lawful basis for collecting this data and must tell your visitors what you do with it. We will not use it for any purpose of our own.
Our commitments as processor
- Only on your instructions. We process this personal data only to provide the service and as you direct, not for our own purposes.
- Confidentiality. People with access are bound to keep it confidential.
- Security. We apply appropriate technical and organisational measures: encryption in transit and access limited to what is needed to run and support the service.
- Sub-processors. We use the sub-processors listed below, place equivalent data-protection obligations on them, and stay responsible to you for their performance.
- Breach notice. If a personal-data breach affecting your data occurs, we will notify you without undue delay so you can meet your own reporting duties.
Sub-processors
We use a small, stable set of providers to run the service. Each receives only what it needs.
- Cloudflare (Cloudflare, Inc.): hosting, edge compute and data storage (United States / global). Everything the service stores lives here. Their privacy policy.
- Creem (Armitage Labs OÜ): payments, as merchant of record (Estonia / EU). Receives billing details directly; we never see card numbers. Their privacy policy.
- Resend (Plus Five Five, Inc.): transactional email such as sign-in links (United States). Receives the recipient email address. Their privacy policy.
- Google: checks destination URLs against a known-threat list, and confirms identity if you sign in with Google (United States). Receives the destination URL, not your visitors' submissions. Their privacy policy.
- Anthropic (Anthropic, PBC): answers questions visitors type into a page assistant, where the page's owner has turned that on (United States). Receives the visitor's message and the page's own content, nothing identifying the visitor. Their privacy policy.
- DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.): writes and rewrites text on the features that say so (China). Receives what you typed into that box, at the moment you ask for it. Your visitors' submissions never reach it. Their privacy policy.
- fal (Features & Labels, Inc.): generates artwork and cover images on request (United States). Receives an image description and, for QR artwork, the pattern of the code. Your visitors' submissions never reach it. Their privacy policy.
If we add or change a sub-processor, we will update this list. Material changes are announced to account holders with reasonable notice so you can object.
Changes to this list
- 6 August 2026 · payments moved from Lemon Squeezy to Creem (Armitage Labs OÜ). Both act as merchant of record and receive billing details directly; card numbers have never reached us under either. Processing location moved from the United States to Estonia / EU.
- 10 September 2026 · Anthropic, DeepSeek and fal added. This is a disclosure that followed the processing rather than preceding it, and we would rather say so than let the dates go unnoticed. Anthropic and DeepSeek were named in our Privacy Policy from the day each feature shipped, and were missing from this list only. fal was named in neither, and should have been listed here from the first image it generated. None of the three has ever received the personal data your visitors submit to you, which is what this addendum governs; the omission was a disclosure failure, not a change in what they receive.
- 10 September 2026 · the contracting entity added beside each provider's trading name, so a reader can check who the counterparty actually is rather than take a brand name for one. Google's entity is not stated because it varies by account and region, and a wrong entity in this list is worse than none; ask us and we will tell you which one is on our billing account. Nothing about who processes what changed with this entry.
International transfers
These providers operate in the United States, Europe and, in DeepSeek's case, China, so personal data may be processed outside your country. Where a transfer needs a safeguard under the GDPR, such as the Standard Contractual Clauses, we rely on the appropriate mechanism offered by the provider. The China-based provider is used only for text you send it yourself and never receives your visitors' submissions.
Helping you meet your duties
Taking into account the nature of the processing, we will give you reasonable help to respond to requests from your visitors to see, correct, export or delete their data, and to meet your security, breach-notification and impact-assessment obligations. Most of this you can do yourself from your account; for anything else, write to info@taproute.io.
Return and deletion
You can export or delete the entries collected through your pages at any time. When you close your account, this data is deleted, unless we are required by law to keep specific records (for example, sales records for tax). Export anything you need first. After deletion we cannot recover it.
Accepting this addendum
This addendum applies automatically when you use taproute or Popin to process your visitors' personal data, and forms part of our Terms of Service. If your organisation needs a countersigned copy for its records, write to info@taproute.io and we will arrange one.