Sub-processors

Who they are

• OVH SAS

  What it does:

  Server hosting: the application, the database, uploaded screenshots and backups.

  What it sees:

  Everything stored in Two Cents.

  Where:

  France

• Brevo (Sendinblue SAS)

  What it does:

  Sends our email: sign-up and password messages, and the notification emails you turn on.

  What it sees:

  Recipient address, and the text of the notification (which can include the message a visitor sent).

  Where:

  France, servers in Germany

• Stripe Payments Europe, Ltd

  What it does:

  Takes payment for paid plans, issues invoices and works out VAT.

  What it sees:

  Name, email, billing details and card data. The card number goes to Stripe directly and never to our servers.

  Where:

  Ireland; may transfer data to the United States under the EU–US Data Privacy Framework and standard contractual clauses

What is not on the list, and why

• Visit statistics run on Plausible, which we host ourselves on our own server. No analytics company receives anything.
• Slack and Discord receive a notification only if you connect your own webhook. They are your providers, chosen by you, under your own agreement with them.
• Google is involved only if you choose “Continue with Google”. It is your own identity provider, under your own agreement with it: we receive your name and email address from it, and it learns that you signed in to Two Cents. We send it nothing else.
• Fonts and the widget are served from our own domain. Nothing is loaded from a third-party font or script host.

When the list changes

We tell account holders by email at least 30 days before a new sub-processor starts, and this page is updated the same day. The data processing agreement explains your right to object. Questions: sylvain@twocentsbox.com.