Sub-processors
Last updated: 3 November 2026
This legal document is provided in English.
1. What this list is
Yumankind OÜ ("Prson", "we") runs Prson with the help of other companies. This page lists every one of them that processes personal data for us. It is split by product, because each product uses different providers:
- The Prson wallet: the Prson app, app.prson.net, the Verifications API, Sign in with Prson and the developer console (section 2).
- Human agents: agents.prson.net, its console, and the human-agents API and MCP server (section 3).
- The marketplace at prson.net (section 4).
When an organisation uses the Verifications API, Sign in with Prson or the human-agents API, we process some personal data on its behalf, under our data processing addendum (DPA). For that data, the providers marked Yes under "For organisations" are our sub-processors, and the organisation authorises them by accepting the DPA. The other providers only handle data we are responsible for ourselves (for example a person's own wallet), and never the data we process for an organisation.
We have a contract with each provider that limits what it may do with the data. How long we keep data is in the Privacy Policy and, for organisations, in Annex 1 of the DPA.
2. The Prson wallet, Verifications API and Sign in with Prson
| Provider | What for | Personal data | Where | Transfer safeguard | For organisations |
|---|---|---|---|---|---|
| Cloudflare, Inc. | Runs our API and websites; our databases (D1) and file storage (R2); queues for email, push and webhooks; email we send (Email Sending) and receive (Email Routing); the relay that connects a browser and a phone for Sign in with Prson; bot checks on public forms; server logs. | Everything we hold for the service: wallet and account records, verification requests and answers, photos, videos and PDFs, notifications, emails, and IP addresses while requests pass through. | Databases and file storage: EU (created in Cloudflare's EU jurisdiction). Network, email delivery and logs: Cloudflare's global network. | EU–US Data Privacy Framework; Standard Contractual Clauses | Yes |
| Google LLC (Firebase Cloud Messaging) | Push notifications to phones: verification requests and their results, and notifications from websites the person allowed. | Device push token; the notification's title and text. On iPhones that support it, the notification is sealed end to end, so Google and Apple see only a generic line. | USA and Google's global network | EU–US Data Privacy Framework; Standard Contractual Clauses | Yes |
| Apple Inc. (Apple Push Notification service) | Delivers push notifications to iPhones, passed on by Firebase Cloud Messaging. | Device push token; the sealed notification. | USA | EU–US Data Privacy Framework; Standard Contractual Clauses | Yes |
| Google LLC (Firebase Authentication) | Sign-in sessions for the app and our websites. Sending a code by text message when a person verifies their phone number in the app. | Account id, email address, phone number (when verifying it), sign-in tokens, IP address. | USA | EU–US Data Privacy Framework; Standard Contractual Clauses | No |
| Pingen GmbH (Switzerland) | Printing and posting the letter with a one-time code when a person verifies their postal address in the app. | The person's name and postal address, and the letter (which carries only the code and our explanation). Delivery status. | Switzerland, and the print and posting sites Pingen uses in the EU | EU adequacy decision for Switzerland | No |
| Google LLC (Firebase App Check, Play Integrity) and Apple Inc. (App Attest, DeviceCheck) | Checking that the app is genuine and runs on a genuine phone. | Device attestation results and certificates, app id. Not the person's files or messages. | USA | EU–US Data Privacy Framework; Standard Contractual Clauses | No |
| Google LLC (Firebase Crashlytics, Remote Config) | App crash reports, only if the person turns them on in Settings. App settings. | Crash type and stack trace, device model, system and app version, an installation id. | USA | EU–US Data Privacy Framework; Standard Contractual Clauses | No |
| Stripe Payments Europe, Limited (with Stripe, Inc.) | Card payments: organisations' top-ups of their prepaid balance. | Billing name and email, payment details (held by Stripe, never by us), payment status. | EU (Ireland) and USA | EU–US Data Privacy Framework; Standard Contractual Clauses | No |
| Better Stack, Inc. | Error reports from app.prson.net pages. | The error, the time, the browser's name and version, and the page address cut to its first part. No account details. | EU (Germany) | Stored in the EU | No |
3. Human agents (agents.prson.net and the human-agents API)
| Provider | What for | Personal data | Where | Transfer safeguard | For organisations |
|---|---|---|---|---|---|
| Cloudflare, Inc. | As in section 2: API, websites, databases, file storage, queues, email and logs. | Agents' accounts, tasks, proof photos and videos with their location, reports, video applications, interviews, results and webhooks. | Databases and file storage: EU. Network, email delivery and logs: global. | EU–US Data Privacy Framework; Standard Contractual Clauses | Yes |
| Google LLC (Firebase Cloud Messaging) and Apple Inc. (Apple Push Notification service) | Push notifications to agents: task offers and updates on their work. | Device push token; the notification, which can include a task's title (sealed end to end on iPhones that support it). | USA and Google's global network | EU–US Data Privacy Framework; Standard Contractual Clauses | Yes |
| OpenAI | Checking tasks against our content policy (automated moderation). Voice interviews: speaking the questions, transcribing the answers, and summarising and scoring them against the requester's questions. | Task titles and instructions; interview questions; agents' recorded answers and their transcripts. | USA | Standard Contractual Clauses | Yes |
| Google LLC (Firebase Authentication) | Agents' and requesters' sign-in. | Account id, email address, sign-in tokens, IP address. | USA | EU–US Data Privacy Framework; Standard Contractual Clauses | No |
| Google LLC (Google Maps Platform) | Finding the country of an agent's work area. | Coordinates of the work area, rounded to about 1 km. | USA | EU–US Data Privacy Framework; Standard Contractual Clauses | No |
| Stripe Payments Europe, Limited (with Stripe, Inc.) | Requesters' top-ups by card. Agents' payouts (Stripe Connect, which checks payout accounts itself). | Billing details; agents' payout account details and identity checks, held by Stripe. | EU (Ireland) and USA | EU–US Data Privacy Framework; Standard Contractual Clauses | No |
4. The marketplace (prson.net)
For the marketplace, Prson decides why and how data is used, so none of these providers acts for an organisation under the DPA.
| Provider | What for | Personal data | Where | Transfer safeguard |
|---|---|---|---|---|
| Cloudflare, Inc. | As in section 2, and drawing map pictures of a request's place for our emails (Browser Run). | Customers' requests, messages, addresses and files; businesses' details; emails. | Databases and file storage: EU. Network, email delivery and logs: global. | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Google LLC (Firebase Authentication) | Customers' and businesses' sign-in on prson.net. | Account id, email address, sign-in tokens, IP address. | USA | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Google LLC (Google Maps Platform) | Address search on the website, and turning addresses into coordinates. | The address typed; the browser's IP address. | USA | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Google LLC (Gemini API) | Finding businesses that might do the job. | A summary of the request, the town and country, and coordinates rounded to about 100 m. Not who the customer is. | USA | EU–US Data Privacy Framework; Standard Contractual Clauses |
| OpenAI | Reading requests and messages, writing them up for businesses, translating, and finding similar requests (embeddings). | Request text and form answers, messages, names in them. | USA | Standard Contractual Clauses |
| Stripe Payments Europe, Limited (with Stripe, Inc.) | Card payments, refunds and business plans. | Billing name and email, payment details (held by Stripe), payment status. | EU (Ireland) and USA | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Overblast (our social media tool), and Zernio, which it runs on | Receiving direct messages, comments and ad leads from Prson's social media accounts, and sending our replies. | Messages and comments, names, usernames and account ids on the network, lead-form answers. | Outside the EEA | Standard Contractual Clauses |
5. Services your browser or phone contacts directly
These services don't receive data from us. Your browser or phone fetches files from them, which shows them your IP address, your browser or device details and what is fetched. None of them is used for an organisation's data.
- Google Fonts (Google LLC): fonts on app.prson.net, and the font in the Prson app, which the app downloads the first time it needs it.
- OpenStreetMap (OpenStreetMap Foundation, United Kingdom): map tiles on app.prson.net, when a proof you open shows where it was taken.
- OpenFreeMap: map tiles in the Prson app (where a proof was taken, choosing a place) and on the coverage maps of agents.prson.net.
On prson.net and agents.prson.net, fonts and icons are served from our own site.
6. Not on this list
- Organisations and websites that receive what a person chooses to share with them. They decide what they do with it, under their own privacy notices.
- Apple (App Store) and Google (Google Play) for purchases in the app. They sell to the person under their own terms; we receive a receipt to confirm the purchase.
- Social networks (Meta for Instagram and Facebook, and the others we're on), where messages, comments and lead forms happen. They act under their own privacy policies.
- fal.ai: draws illustrations for marketplace service pages from a description of the service. It receives no personal data.
- GitHub: when a developer applies for the open-source plan, we read the public repository they name. We send only the repository's name.
- Public domain records (rdap.org, and DNS through Cloudflare): when a person or developer verifies a website domain, we look up that domain's public records.
7. Transfers outside the EU
We store our databases and files in the EU. Where a provider above processes personal data outside the European Economic Area, the transfer relies on the EU–US Data Privacy Framework if the provider is certified under it, or on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914): Module 2 for data we are responsible for, and Module 3 for data we process for an organisation. Where needed, we assess the transfer and add safeguards. The UK and Switzerland have EU adequacy decisions.
8. Changes to this list
This is the notice of changes that section 5 of the DPA refers to.
- At least 30 days before we add or replace a provider marked Yes under "For organisations", we update this page and email the people who have access to each organisation's account on Prson. The email says who the provider is, what it will do, and where.
- An organisation can object to the change during those 30 days, on reasonable data protection grounds, by writing to [email protected]. We then look for a solution with you, such as not using that provider for your data. If we can't find one, you can stop using the affected service before the change applies, and we refund your unused prepaid balance.
- If we must replace a provider urgently, to keep the service secure or running, we may do it at shorter notice. We then tell you as soon as we can, and you can object in the same way.
- Other changes to this page (for example a provider for the marketplace only) apply when we publish them.
Last changed: 3 November 2026. First version of this list.
9. Contact
[email protected] · Yumankind OÜ, Sepapaja 6, 15551 Tallinn, Estonia · Registry code 16232402