Privacy

Sub-processors
for TapInn.

This is an English translation provided for convenience; the Norwegian version is the legally binding text. APREX AS uses necessary sub-processors to operate TapInn. Below are the key data processors. All processors are governed by a data processing agreement (DPA) and/or standard contractual terms.

In brief

Vercel: Hosting, application operations, serverless functions and any Vercel Blob storage (EU (Frankfurt, Germany) for production operations. Vercel edge/CDN may process network traffic at the nearest edge location under Vercel’s DPA). Neon: PostgreSQL database (EU (Frankfurt, Germany)). Vercel Analytics / Speed Insights: Privacy-friendly usage statistics and real-user web performance measurement for public pages and product surfaces (The Vercel platform, tied to the production project in the EU (Frankfurt, Germany)). CoreDesk: Customer support via the TapInn proxy (EU / Norway). Postmark: Sending transactional email, for example onboarding, password reset and customer follow-up (USA, with a DPA and Standard Contractual Clauses (SCCs) as the transfer basis). Sentry: Error monitoring, stack traces and performance tracing for operations and security (EU ingest (Germany) under Sentry’s DPA). Redis Ltd (Redis Cloud via Vercel Marketplace): Shared cache for rate limiting and security counters, for example repeated sign-in attempts and API calls (EU (Frankfurt, Germany – eu-central-1) under Redis’s data processing agreement). Google Firebase Cloud Messaging (Google Ireland Limited / Google LLC): Delivering push notifications to the Android app for events the Customer has enabled, for example a new shift, message or approval (Google infrastructure in the EU and the USA. Transfers outside the EEA are covered by Google’s data processing terms with the EU Standard Contractual Clauses (SCCs)). Apple Push Notification service (APNs): Delivering push notifications to the iOS app for events the Customer has enabled, for example a new shift, message or approval (Apple infrastructure globally, including the USA. Use is governed by the Apple Developer Program License Agreement and its APNs terms; Apple international transfers from the EEA are subject to Standard Contractual Clauses (SCCs)).

Details

Explained in practice.

Vercel

Hosting, application operations, serverless functions and any Vercel Blob storage. Data: Traffic data, application data, operational logs and files where Blob is enabled. Region: EU (Frankfurt, Germany) for production operations. Vercel edge/CDN may process network traffic at the nearest edge location under Vercel’s DPA. DPA: Standard data processing agreement.

Neon

PostgreSQL database. Data: TapInn product data. Region: EU (Frankfurt, Germany). DPA: Standard data processing agreement.

Vercel Analytics / Speed Insights

Privacy-friendly usage statistics and real-user web performance measurement for public pages and product surfaces. Data: Page views, route/URL path, referrer, aggregate public interaction and conversion events, Core Web Vitals, element attribution, and technical browser, device, network and country metadata without person or IP identification. Region: The Vercel platform, tied to the production project in the EU (Frankfurt, Germany). DPA: Standard data processing agreement.

CoreDesk

Customer support via the TapInn proxy. Data: Support enquiries and conversation references. Region: EU / Norway. DPA: Standard data processing agreement.

Postmark

Sending transactional email, for example onboarding, password reset and customer follow-up. Data: Email address, name, message content and delivery metadata. Region: USA, with a DPA and Standard Contractual Clauses (SCCs) as the transfer basis. DPA: Standard data processing agreement.

Sentry

Error monitoring, stack traces and performance tracing for operations and security. Data: Error events, technical route/runtime metadata, stack traces and release/build metadata. Default PII collection is off. Region: EU ingest (Germany) under Sentry’s DPA. DPA: Standard data processing agreement.

Redis Ltd (Redis Cloud via Vercel Marketplace)

Shared cache for rate limiting and security counters, for example repeated sign-in attempts and API calls. Data: Short-lived counters keyed by IP address, user ID or a hash of a token. No customer content, messages or records. Region: EU (Frankfurt, Germany – eu-central-1) under Redis’s data processing agreement. DPA: Standard data processing agreement.

Google Firebase Cloud Messaging (Google Ireland Limited / Google LLC)

Delivering push notifications to the Android app for events the Customer has enabled, for example a new shift, message or approval. Data: Push device token and the title and body of the notification. No location data. Region: Google infrastructure in the EU and the USA. Transfers outside the EEA are covered by Google’s data processing terms with the EU Standard Contractual Clauses (SCCs). DPA: Standard data processing agreement.

Apple Push Notification service (APNs)

Delivering push notifications to the iOS app for events the Customer has enabled, for example a new shift, message or approval. Data: Push device token, generic notification text and opaque recipient/delivery references. No message, absence, task, location or other business data is sent in the APNs payload. Region: Apple infrastructure globally, including the USA. Use is governed by the Apple Developer Program License Agreement and its APNs terms; Apple international transfers from the EEA are subject to Standard Contractual Clauses (SCCs). DPA: Standard data processing agreement.