Subprocessors

About this list #

FLOW FN PTE. LTD. (UEN 202617303Z), a company incorporated in Singapore uses the companies below to provide Nayto. Each processes personal data only on our instructions, under a written contract that requires it to protect that data. The Data Processing Addendum explains how we choose them and how you can object to a new one.

Hosting, in Singapore #

• DigitalOcean, LLC - runs the console, the API, our background workers, the message service that screens connect to, and our cache. Location: Singapore (SGP1). Requests to the console and the API pass through Cloudflare's network on the way, which DigitalOcean uses as its own subprocessor for that.
• Neon, Inc. - the database: accounts, organizations, screens, schedules, activity records and billing status. Location: Singapore (AWS ap-southeast-1).
• Amazon Web Services, Inc. (Amazon S3) - storage for the media you upload and the versions made for your screens to play, and for encrypted copies of the database kept for recovery (at most 30 days). Location: Singapore (ap-southeast-1).

Payments #

Stripe, Inc. and Stripe Payments Singapore Pte. Ltd. - takes payment for paid plans, manages subscriptions and invoices, and runs the checkout and billing pages the console sends you to. Stripe receives the billing name, email address and payment details entered on its pages, and your organization's plan. For card data, Stripe acts as an independent controller under its own privacy policy. Location: the United States, Singapore and other countries where Stripe operates.

Running the Service #

• Amazon Web Services, Inc. (Amazon SES) - sends the Service's email: invitations, address confirmations, password resets and notices. It receives each recipient's address and the message, and tells us which addresses bounced or complained. Location: the United States (us-east-1, Northern Virginia).
• Functional Software, Inc. (Sentry) - receives reports of errors in the player app, in the console in your browser, and in our servers, so we can fix them: what went wrong, the app version, the device model or browser and operating system, and, from the console, the page's address and what led up to the error. Credentials and network addresses are removed from reports before they are sent, reports from the console reach Sentry through our servers rather than from your browser, and Sentry is set not to store network addresses. Location: the European Union (Germany).
• Better Stack, Inc. - checks from outside that the Service is up, and holds our server logs, which include the network address and browser details of requests. Location: the European Union.
• Cloudflare, Inc. (Turnstile) - checks the signup form, and a sign-in after many wrong passwords, for automated abuse, using your network address and signals from your browser. Location: Cloudflare's global network, including the United States.

What is not on this list #

No analytics provider, no advertising network, no customer-data platform and no session-recording tool. We use none of them. The advertising on Free plan screens is chosen and served by us, not by an advertising network.

Transfers outside Singapore #

Your content and the database stay in Singapore. Where a provider above processes personal data elsewhere, its contract with us requires protection comparable to Singapore's PDPA, and, where the GDPR applies, includes the European Commission's standard contractual clauses.

Changes to this list #

Before a new subprocessor begins to process personal data, we update this page and email the owners of every organization at least 30 days ahead. Questions and objections go to privacy@nayto.io.

How this document changes #

Every version of this document has a number and the date it applies from, both printed under the title. A change is published as a new version rather than an edit to this one, so what the document said on any day can be checked.

When a change matters to what you have agreed or to how we use your data, we tell you before it takes effect. Earlier versions are available from legal@nayto.io.