This page lists the service providers that process personal data for BA Solutions, LLC in running SetLinks. It covers both kinds of processing our Privacy Policy describes: the click data of people who follow our customers' links, which we process as a processor on each customer's behalf, and our customers' own account data, for which we are the controller. Amazon Web Services stores and processes click data, and is our subprocessor for it within the meaning of Article 28 of the GDPR and the UK GDPR; the other providers process our customers' account data, for which we are the controller.
Under our Data Processing Addendum, customers give us a general authorisation to engage subprocessors. In return, we bind each subprocessor that processes click data on a customer's behalf by written contract to data-protection obligations no less protective than those the Addendum places on us, we remain responsible to our customers for its performance, and we announce any new or replacement subprocessor on this page and in the legal change log, and tell the owner of each team by email, at least 30 days before it starts processing personal data.
If you are a customer and object to a new subprocessor on reasonable data-protection grounds, write to support@setlinks.io within that 30-day period. We will discuss your objection with you in good faith. If we cannot address it, you may end the affected subscription, or, on the Free plan, stop using the Service, and we will refund any fees you paid in advance for the period you will no longer use.
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Amazon Web Services | Hosting, databases, file storage, content delivery (CDN) and logs | All Service data, including customers' account and link data, click records, and CDN access logs that contain visitors' IP addresses | EU (Stockholm, Sweden); CDN edge locations worldwide |
| Google Firebase Authentication | Sign-in, including Google Sign-In | Email address, display name, password (stored hashed by Google), Google identity | United States |
| Stripe | Payments | The billing email, name, address and card details you enter on Stripe's forms; your subscription | United States |
| Resend | Transactional email, and receiving the email you send to our @setlinks.io addresses | Recipient address and the email's content (for invitations, the inviter's name and email and the team name; for receipts, the plan, amount, card's last four digits and a link to the invoice PDF; for support replies, the conversation's subject, the reply text and a link to the conversation); and the emails, including abuse, copyright and privacy requests, that you send to us | United States (sending); incoming email is received through Amazon Web Services mail servers |
| Sentry | Error monitoring | Error reports, performance traces and service log lines, configured not to send the personal data Sentry collects by default; reports may include internal account IDs; recordings of dashboard sessions, and in the apps of the moments before an error, with all text, input and images hidden | EU (Germany) |
| Chatwoot | Our support desk, built on the open-source Chatwoot software, at desk.basolutions.io | Your name, email address, an identifier linking you to your SetLinks account, your team ID, and the messages and attachments in your conversations | desk.basolutions.io |
| Apple | Sign in with Apple, in the mobile apps | Apple identity | United States |
| PostHog | Analytics for our website, www.setlinks.io, our dashboard and our mobile apps — never for short links or click data | Visitors to our website: pages opened, referring page, browser, device type and screen size, links and buttons clicked, IP address and the approximate location derived from it, and a random visitor identifier for those who accept the website's cookie. Dashboard and app users: the same usage data, your internal account ID, your team ID and plan, and recordings of your sessions with all text, input and images hidden | EU (PostHog EU cloud) |
Click data about the people who follow our customers' links is stored with Amazon Web Services in the EU (Stockholm, Sweden). Chatwoot is open-source support software; it is listed because the support desk built on it holds your support conversations.
Stripe also acts as an independent controller for the payment data it collects, for its own fraud-prevention and legal-compliance purposes, under its own privacy policy. Where data is transferred outside the EEA, the UK or Switzerland, the safeguards described in § 7 of our Privacy Policy apply.
To record which country a click came from, we look up the visitor's IP address in the DB-IP IP to Country Lite database, and then discard the address. We download that database into our own systems and run the lookup there: nothing is sent to DB-IP, so DB-IP is a data source, not a subprocessor.
IP Geolocation by DB-IP. The database is licensed under the Creative Commons Attribution 4.0 International licence (CC BY 4.0).
This is version 1.3 of this list. We announce a new or replacement subprocessor here and in the change log, and tell the owner of each team by email, at least 30 days before it starts processing personal data. If we must replace a subprocessor sooner, because it stops providing its service or to protect the security of the Service or of personal data, we will announce the change as soon as we reasonably can, and you may object within 30 days of that announcement, with the same consequences as in § 1. We may remove a provider from this list without advance notice.
Questions about this list, or an objection to a change, can be sent to support@setlinks.io.