Current subprocessors
A subprocessor is a company we use to run Tableaf that may handle personal data for us. These are the ones we use today.
| Company | What it does | Data it handles | Where |
|---|---|---|---|
| Cloudflare | Hosts the site and delivers it worldwide. Runs our database (D1) and our cookieless analytics. | Account data: email address, plan and billing status, page counts, sign-in sessions, team membership. Request details such as IP address. Page-view analytics. | Cloudflare’s global network. Our database sits in the region it is set up in. |
| Resend | Sends our sign-in emails. | Your email address, and the content of the sign-in email. | United States and other regions where Resend operates. |
| Dodo Payments | Takes payments as merchant of record. It is the seller, and handles invoices, VAT and sales tax, and refund processing. | Your payment details, billing address and email address. We receive back customer and subscription IDs, and never card details. | Wherever it processes payments worldwide. |
Cloudflare, Resend and Dodo Payments are also independent companies with their own privacy policies and terms for the parts they run themselves.
Planned: OCR provider
| Company | What it does | Data it handles | Where |
|---|---|---|---|
| To be named before OCR launches | Reads scanned PDFs on a server, for paid plans. | Only the scanned files you choose to send, one consent click per file. Files are deleted within 1 hour and never used for training. | To be confirmed before launch. |
Scanned PDF reading is not live yet. This list will be updated, and the date at the top changed, before it goes live.
What they never receive
Text PDFs are read in your browser. None of the companies above receives the file, its transactions or its file name. The only planned exception is a scanned PDF that you choose to send for OCR.
Changes to this list
If we add or replace a subprocessor, we will update this page first and change the effective date. Business customers who need to be told directly, or who need a data processing agreement, can email [email protected].
More on how we handle data is on the security page and in the privacy policy.