Providers that process data
1. What this list is for
Timbro runs on services from other companies. This list names the providers that receive personal data so that INDEXA, S.R.L. (“INDEXA”) can operate Timbro, with the reason they receive it, the data they receive, and where they process it.
It forms part of the Data Processing Agreement and the Privacy Policy. INDEXA shares with each provider only the data it needs for its function and requires confidentiality and appropriate security measures from it.
2. Providers
| Provider | Purpose | Data it receives | Where it processes the data |
|---|---|---|---|
| Vercel Inc. | Hosting of Timbro, its functions, and its network protection | All data that Timbro processes, in transit and during execution | United States (Washington, D.C.) |
| Neon | Databases | Account, business, payment, and invoice data | United States (AWS, us-east-1 region) |
| Resend | Sending emails: sign-in codes, notices, and invoices | Email address, name, and the content of the message | Outside the Dominican Republic |
| Functional Software, Inc. (Sentry) | Error and performance logging | Technical error data, without the content, headers, cookies, or parameters of requests | Outside the Dominican Republic |
| Bento | Emails replying to contact and support requests, following up on business registration, and requesting feedback | Email address, name, the business’s data and its registration in Timbro, and the content of the message | Outside the Dominican Republic |
| Google LLC | Sign-in with Google and Google Pay, when the person uses them, and address search when registering a business | Google account identifier and email address; the text of the address searched | Outside the Dominican Republic |
Where the last column says “Outside the Dominican Republic”, the provider determines the exact region where it processes the data.
3. Serve
Serve is in beta. When a business activates the Serve WhatsApp channel, these providers are involved:
- Meta (WhatsApp Business): is the channel. It receives the phone numbers, messages, voice notes, and media content of the conversation, and delivers the business’s reply messages. Meta processes that data in its role as the channel, under its own policies and those the business accepts with Meta. It is listed here because INDEXA also sends it the reply messages.
- Artificial intelligence model providers: generate the assistant’s replies and, where applicable, transcribe voice notes. They receive the text of the messages, the part of the business’s catalog needed to respond, and the voice notes that are transcribed.
The data in these conversations is processed on behalf of the business, under the Data Processing Agreement and the Serve annex. No model provider receives data from a business’s customers before it appears on this list with its name and location, and INDEXA gives notice of each addition under section 5.
4. Who is not an INDEXA provider
Acquirers (Azul and CardNet) and DGII are not INDEXA providers. They receive data in their own capacity: the acquirer processes the payment under its contract with the business, and DGII receives tax documents as the tax authority.
5. Changes to this list
This list is kept up to date on timbro.do. INDEXA gives businesses at least 30 days’ notice before adding a provider that will process their customers’ data, so that the business can object or cancel.
If you have questions about a provider or want information about the applicable safeguards, write to hola@timbro.do.