1. Who we are and what this policy covers
Typenode, Inc. ("Typenode", "we", "us" or "our") provides the Typenode website at typenode.ai, the application at app.typenode.ai, and the Typenode MCP service (together, the "Services"). Typenode is a Delaware corporation, Delaware file number 10510359. Our current management and operations are based in Barcelona, Spain. Our company mailing address is 1111B S Governors Ave, #82884, Dover, DE 19904, United States. That mailing address is not a statement that our operations are based in Delaware.
Contact us about privacy or to exercise your rights at privacy@typenode.ai. Report suspected unauthorized access or a security issue to security@typenode.ai.
This policy explains our collection, use, disclosure and retention of personal information about website visitors, prospective customers, account holders, authorized Workspace members and people whose information is processed through customer Workflows. The Services are for businesses, including individuals buying for their trade or profession. Business eligibility does not remove the privacy rights of individuals whose information we process.
A Customer is the business or professional contracting for the Services. A Workspace is its shared service environment. A Member is an individual authorized to access that Workspace. A Workflow is a customer-configured automation; a Run is an execution of it. Customer Content includes the information supplied or generated for the Customer through the Services, such as Workflow configurations, files, inputs, outputs, Run history and Integration Credentials. Customer Content can include personal information and confidential business information.
2. Our different data-protection roles
We act as a controller when we decide why and how to process information for our own account administration, billing, prospecting, product analytics, communications, service security and legal obligations. This policy describes that processing.
We generally act as a processor when we host or process personal information in Customer Content to carry out a Customer's instructions. The Customer may itself be a controller or a processor acting for another organization. Our Data Processing Agreement governs that processing and supplements the Terms of Service. Our Subprocessor List identifies the providers used for customer-instructed processing.
A Customer controls its Workflows, integrations, authorized Members and the purposes for which it submits other people's information. If your information is in a Customer's Workspace, that Customer's privacy notice and instructions also apply. Send requests concerning that information to the Customer where possible. You may also contact us; we will help identify the appropriate route and assist the Customer as required by our agreement and applicable law.
An agency or service provider's membership does not make it the owner of its client's Workspace or automatically determine its legal processing role. Access granted by a Customer allows its authorized Members to view or use information within their permissions.
3. Information we collect and where it comes from
Account, authentication and Workspace information
We collect information you supply when signing up or administering an account, including email address, account verification status, Workspace name, membership and role information, invitations, Terms acceptance and service preferences. We record trial eligibility and dates, the applicable offer, subscriptions, execution-credit balances and related account activity. We may use a verified email domain when determining an offered trial; a personal email address does not by itself mean someone is a consumer.
Our authentication provider processes the information needed to authenticate and protect accounts, including authentication identifiers, session information and sign-in metadata. Password authentication uses a cryptographic password hash rather than storing a readable account password. If you choose Google sign-in, Google supplies account and basic profile information for authentication. This sign-in flow does not give us your Google password. Separately authorizing a Google integration for a Workflow is a different flow with its own permissions.
Customer Content and connected services
We receive Customer Content from Customers, their authorized Members, their configured triggers and integrations, and Workflow execution. This may include ordinary business contact information, business records, files, configuration values, Workflow instructions and Run inputs and outputs. We also process Integration Credentials, such as authorized API keys or OAuth tokens, through the credential-management features used to connect external services.
Only submit information you are entitled to process. The Services do not support the restricted data and high-risk uses described in our Terms of Service. Do not place Integration Credentials in public links, ordinary prompts, feedback or unprotected Workflow content. Our restrictions do not remove our obligations if restricted information is actually received.
Billing and payment information
Stripe processes payments, subscriptions, credit purchases and related billing. We provide billing contact and purchase details and receive records such as customer, payment, subscription and invoice identifiers, purchase amounts, payment status and subscription dates. Stripe may collect billing address, tax information and payment details directly at checkout. We do not store full payment-card numbers in our application. Stripe also processes information for its own payment, fraud-prevention, regulatory and legal purposes under its privacy notice.
Communications, booking, applications and feedback
We process information you send us in support requests, contact messages, booking or application forms and voluntarily supplied feedback. This may include contact details, correspondence and examples you choose to provide. Our pages can link to Tally forms and Cal.com booking pages. Those providers process your submissions under their own notices, and we receive the information supplied to us through those channels. Typenode's cookie choices do not control those separate websites.
Prospecting and business contacts
We also collect business-contact information for Typenode's own prospecting and relationship management. Sources include information you provide, publicly available business websites and professional profiles, and research or enrichment services. Information may include a person's name, work contact details, employer, professional role, profile or source URL, and relevant outreach and response history. Apify supports our own research; Attio and Instantly support contact management and outreach. Public availability does not itself give us permission to send every kind of marketing message. Contact us for information about the source of your record or to exercise your rights.
Where we obtain personal information from another source, we will provide the individual privacy information required by applicable law within the required period. Under GDPR this is generally within one month and, if earlier, at our first communication with you or first disclosure to another recipient, subject to lawful exceptions. Making this policy available does not replace an individual notice where one is required.
Transactional email and business communications
Resend delivers account-related and other transactional emails. Email providers process recipient addresses, message content and relevant delivery metadata. Google Workspace supports our business email and related documents. Where we use Quo for a business call, the service may process the participants' contact details and call metadata. Transactional messages serve account, security or service purposes; optional promotional communications are handled separately.
Technical, operational and consent information
We and our providers process request and service metadata needed to deliver, secure and diagnose the Services. This can include IP address, browser or client information, timestamps, request URLs or route information, service and error events, authentication activity, and Workspace, Workflow, Run and correlation identifiers. Identifiers and logs can remain personal information when linked to an individual.
Our consent service processes your privacy choices and related consent records, including information needed to resolve applicable choices and document them. Platform Google Analytics and Website PostHog analytics can process visit, feature-use and interaction information as described in Section 10. Analytics information can include event names, timestamps, browser or device details. Website measurement excludes account, Member and Workspace identifiers and Workflow content. Product analytics beyond this Website setup is planned and is not activated by these disclosures.
4. Why we use information and our legal bases
Where EU, UK or other law requires a legal basis, we use the following bases for our controller activities:
| Purpose | Information involved | Legal basis |
|---|---|---|
| Provide an account and the requested Services, manage trials, subscriptions and purchases | Account, Workspace, authentication, service and billing records | Performance of a contract with you or requested steps before entering one; where the Customer is an organization, our legitimate interests in providing and administering its service relationship |
| Authenticate Members, manage invitations and access, and communicate about service administration | Contact, membership, authentication and account activity | Our legitimate interests in managing authorized business access; contractual necessity where the agreement is with you |
| Respond to support requests, inquiries and voluntarily supplied feedback | Contact details, correspondence and relevant diagnostic information or examples | Our legitimate interests in responding and improving service reliability; contractual necessity where applicable |
| Protect the Services, investigate abuse, diagnose failures and enforce lawful restrictions | Technical and security records, relevant account and service information | Our legitimate interests in security, fraud prevention, reliable operation and protecting rights; legal obligation where applicable |
| Keep required accounting, tax, agreement and compliance records, and respond to lawful demands | Billing, transaction, acceptance, correspondence and other relevant records | Compliance with legal obligations; our legitimate interests in documenting agreements and establishing, exercising or defending legal claims |
| Research relevant business prospects and manage relationships | Business-contact, source, professional-profile and outreach records | Our legitimate interests in finding relevant business contacts and managing relationships where permitted, subject to applicable rights, including objection. Promotional email or similar communications require consent where applicable, or a legally permitted exception; legitimate interests alone do not override those communication rules. |
| Prepare and send business, support and service communications | Contact details, correspondence, relevant supplied examples and delivery metadata | Contractual necessity where applicable; our legitimate interests in responding to business inquiries and providing accurate, efficient support; legal obligations for required notices. Customer-instructed personal-data processing remains subject to the DPA and the Customer's lawful instructions. |
| Remember and document privacy choices | Preference and consent records | Compliance with applicable privacy obligations and our legitimate interests in respecting and evidencing your choices |
| Optional visit and interaction measurement | Browser identifiers and visit/event information | Consent for Website measurement. For Platform measurement, consent where required; where applicable law permits measurement without prior consent, our legitimate interests in understanding and improving use of the Services, subject to the choices and opt-outs in Section 10 |
Our legitimate interests are the specific service, security and business-administration purposes above. We consider their impact on individuals and the safeguards and rights available to them. Contact us for more information or to object where that right applies. When consent is the basis, you may withdraw it at any time; withdrawal does not make earlier lawful processing unlawful.
Information needed for authentication, billing and the requested Service is necessary to provide it. If it is not supplied, we may be unable to create an account, complete a purchase or provide the relevant feature. Optional measurement and voluntarily supplied feedback are not required to use the core Service.
For personal information in Customer Content, we process on the Customer's documented instructions under the Data Processing Agreement. The Customer is responsible for the legal basis for its instructed processing.
5. Human access, confidentiality and model training
We limit access to information to what is reasonably needed for requested support, necessary operational or security investigations, abuse prevention, legal obligations and the feedback or examples you voluntarily supply. Sharing an example does not authorize unrelated access to the rest of your Workspace. Confidentiality protections cover confidential business information as well as personal information.
Typenode does not use Customer Content to train or fine-tune AI models. Our current Service connects through MCP and does not provide a Typenode-hosted AI chat builder. We do not treat support access or a feature-request example as permission for model training.
We use OpenAI and Anthropic tools, including ChatGPT and Claude and their APIs, for internal business tasks, experiments and assistance with drafting support or other communications. Relevant information supplied to those tools may include contact details, correspondence and examples provided for the task. These are recipients chosen by Typenode, separate from AI clients independently chosen by a Customer. Their processing is governed by the particular product's terms, privacy rules and settings. Model-improvement sharing is disabled in our ChatGPT and Claude subscription accounts; API settings, retention, feedback and required safety processing have separate rules.
Use of an AI tool does not expand our permission to access Customer Content or authorise its use for model training. Customer Content must remain subject to the limited support purposes, confidentiality and processing safeguards in the Terms and DPA. We do not submit it to voluntary provider-training or feedback programmes.
When you choose an AI application or other MCP client, that application may receive the information you supply to it and the tool results requested through it. Its provider's own terms, settings, retention and training rules apply to that separate relationship. Do not assume Typenode's commitments change those rules. Likewise, an external service you select for a Workflow processes information under the relationship and permissions applicable to that integration.
6. Who receives information
We disclose information for the purposes described in this policy to:
Our infrastructure and service providers: Cloudflare for managed execution, storage, network and operational services; Supabase for database and authentication; Vercel for website hosting; Resend for account and transactional email; Inth for hosted consent management; and Google Analytics and PostHog for analytics. Our operational telemetry configuration also uses Grafana log and trace destinations. These are separate from the ordinary retention of completed Run inputs and outputs.
Stripe: for payment, billing, subscription and related payment-provider purposes.
Business communications, research and administration providers: Google Workspace for business email and documents; Apify for our own prospect research; Attio and Instantly for contact management and outreach; OpenAI and Anthropic for the internal AI-assisted tasks described above; Puzzle and Mercury for accounting and financial administration; and Quo where used for business calls. Information disclosed is relevant to the particular activity.
Tally and Cal.com: when you choose the linked form or booking services and for the submissions received through them.
The Customer and authorized Members: according to the Workspace's access permissions and the Customer's instructions.
Customer-selected integrations and MCP/AI applications: as required by authorized connections, tool calls and Workflow instructions. A connection can send information outside Typenode. Disconnecting a connection does not erase information already received by the external provider.
Professional advisers, authorities and other necessary recipients: where reasonably needed for legal advice, compliance with law, protecting rights and safety, or establishing, exercising or defending claims.
Parties to a corporate transaction: where relevant to a proposed or completed acquisition, financing, reorganization or asset transfer, subject to applicable confidentiality and data-protection requirements.
See the Subprocessor List for customer-data processing functions and provider details. Not every recipient acts only as our processor: payment providers, customer-selected services and authorities may have independent purposes and responsibilities.
We do not sell personal information or share it for cross-context behavioral advertising. Our intended Analytics use is ordinary Service measurement, with client-side advertising and Google Signals use disabled. The cookie and measurement choices described below apply separately from information needed to operate and secure the Services.
7. International processing and transfers
Typenode is a United States corporation with current operations in Spain. Our providers and customer-selected integrations may process information in the United States, the European Economic Area and other countries. The production Supabase project's primary region and the hosted Inth consent projects are configured in Frankfurt, Germany. Those settings do not mean all processing, support access, network operations or subprocessors remain exclusively in the EU.
For covered restricted transfers, established agreements with providers such as Cloudflare, Supabase, Vercel and PostHog include mechanisms such as the European Commission's Standard Contractual Clauses and, where applicable, corresponding UK or Swiss provisions. The safeguard applicable to a particular recipient must be assessed for that processing; this statement does not establish a transfer arrangement for every listed provider. Transfer arrangements depend on the recipient and processing relationship; a primary hosting region alone is not a transfer safeguard. Our Data Processing Agreement addresses transfers for customer-instructed processing. Contact privacy@typenode.ai for information about the safeguards applicable to your information and how to obtain a copy, subject to necessary redaction of confidential information.
Customer-selected external services may involve additional transfers governed by the Customer's arrangements and the external provider's terms.
8. Retention and deletion
We retain information according to its purpose, the status of the account or Workspace, Customer instructions, applicable legal requirements, security needs and the time reasonably needed to resolve requests or claims. Different information has different retention rules:
| Information | Retention approach |
|---|---|
| Completed Run inputs, outputs and history | The standard retention is 30 days after completion, unless a different applicable Workspace retention setting has been agreed. Cleanup is asynchronous. Active or waiting Runs, unsettled processing, failed cleanup and records needed for security or legal purposes can require separate handling. This is not a promise that every copy is erased at exactly the 30-day mark. |
| Workflow configurations, Integration Credentials and other active Workspace data | Retained while needed for the Workspace and authorized connections, until removed or deleted under the applicable instructions and deletion process. The completed-Run schedule does not expire these records. |
| Account, membership and authentication records | Retained while needed to provide and secure access; deleted, de-identified or otherwise handled when no longer needed, subject to shared Workspace ownership and lawful retention requirements. |
| Billing, agreement and compliance evidence | Retained as required for accounting, tax, documenting acceptance, legal obligations and relevant claims. Deleting an account does not require deletion of every legally required payment or agreement record. Stripe applies its own retention rules to its records. |
| Support, inquiries and voluntarily supplied examples | Retained for responding, necessary follow-up, service support and relevant claims; reviewed for deletion or de-identification when no longer needed. |
| Prospect contacts, outreach and objections | Retained while relevant to a lawful business relationship or prospecting purpose, subject to applicable objections and deletion rights. We stop direct marketing when you object and may retain the minimum suppression information needed to honour that choice rather than re-add your contact details. |
| Transactional messages and internal AI-assisted communications | Retained as needed for delivery, support, security, relevant correspondence and lawful recordkeeping. Email and AI providers have their own product-specific storage and deletion rules. Model-improvement opt-outs do not by themselves mean zero retention or erase previously submitted material. |
| PostHog Website analytics | We use these records to compare Website traffic, marketing Campaigns and interest in starting a trial or booking a call. Our current PostHog plan provides a seven-year event-history window. That reporting window is not an automatic deletion guarantee, and PostHog does not offer a shorter configurable event-retention period on this plan. We review continued retention against those purposes and handle applicable deletion requests through the available provider tools. Cookieless counting does not make every record anonymous or reliably identifiable to us. These records do not follow the Google Analytics or completed-Run retention schedule. Contact us for information about retention or your rights. |
| Technical and security logs | Retained for the period reasonably needed for reliability, troubleshooting, security investigations, abuse prevention and legal compliance. They have separate provider settings and do not automatically follow the completed-Run schedule. |
| Consent records | Retained as needed to remember choices and document compliance, taking account of applicable legal requirements and the consent provider's processing. |
| Google Analytics | The property is configured for two-month user-level and event-level retention, with renewal on new user activity disabled. Standard aggregated reporting is not governed by those limits. Expired data is processed for deletion on Google's monthly cycle. Browser cookie expiry is separate from those server-side settings. |
| Backups | Production database backups are scheduled daily. The current Supabase Pro service provides access to the last seven days of backups. That access window is not a guarantee that every backup copy is permanently erased after exactly seven days. Backup handling, provider retention and required recovery processes are separate from active-data deletion. |
Account deletion, Workspace deletion, removal of a Member, disconnecting an integration and cancelling a subscription are different actions. Deleting your individual account does not automatically erase a Customer's shared Workspace. A sole owner may need to transfer ownership or delete the Workspace first. Cancellation also does not automatically delete data already held by Stripe or another external service.
To request deletion or information about retrieval, contact privacy@typenode.ai. Individual output downloads and authorized service access may be available while the relevant information is retained; this policy does not promise a complete one-click Workspace export. We handle applicable access, portability, return and deletion requests through the appropriate request and Customer-instruction process.
9. Your privacy rights
Your rights depend on your location, the applicable law, our role and any statutory exceptions. They may include:
Confirmation of processing and access to personal information.
Correction of inaccurate information and deletion where required.
A portable copy of information where the relevant conditions are met.
Restriction of processing and objection to processing based on legitimate interests; objection to direct marketing.
Withdrawal of consent without affecting the lawfulness of processing before withdrawal.
Opting out of sale, sharing, targeted advertising or certain profiling; limiting certain uses of sensitive information, where applicable.
Protection concerning solely automated decisions with legal or similarly significant effects, where applicable.
Appealing a denied request under applicable US state law and complaining to a competent supervisory authority.
Contact privacy@typenode.ai with the request and enough information to identify the relevant account or processing. An authorized agent may submit a request where the law permits. We may verify identity and authority proportionately, without requesting unnecessary additional information. We respond within the applicable legal period and explain any lawful refusal or extension. To appeal a refusal where an appeal right applies, reply to our response or email the same address stating that you are appealing. We will explain the outcome and the available authority complaint route. We do not unlawfully discriminate or retaliate for exercising an applicable privacy right.
For Customer Content, we may need to refer the request to the Customer and assist it rather than independently change its information. This does not limit rights the law gives you against the responsible controller.
People in the EEA may complain to their competent data-protection authority, including the Spanish Data Protection Agency (AEPD) where appropriate. In the UK, the Information Commissioner's Office is the supervisory authority. Other jurisdictions may provide a complaint route to their privacy regulator or state attorney general. You may contact us first, but you are not required to do so before making a complaint where the law permits it.
10. Cookies, similar technologies and measurement
This section is our integrated cookie policy. Cookies and similar browser storage let a service remember information or choices between requests. Browser and request metadata may also be processed without setting an optional cookie.
Necessary technologies
We use necessary authentication/session mechanisms, security technologies and preference storage to provide requested features and remember privacy choices. Hosted consent management is provided through Inth. Necessary privacy-choice storage remains available when optional measurement is refused, so we can remember and apply that refusal. These mechanisms are used for their necessary functions, not as permission for optional advertising or measurement.
Platform Google Analytics measurement
The Platform application continues to use Google Analytics 4 for visits and interactions where its applicable privacy controls allow it. The marketing Website uses the separate PostHog setup described below. It can use browser identifiers such as _ga and _ga_* cookies. Information can include page URL and referrer, visit times, browser/device information and general location. Enhanced measurement is disabled, including its automatic scroll, outbound-click, site-search, form, video and download tracking. Ordinary measurement remains subject to the applicable privacy controls and effective choices.
Our client configuration denies advertising storage, advertising user-data and advertising-personalization consent, and disables Google Signals and advertising-personalization use for its events. The Google Analytics property also disables Google Signals, advertising personalization and granular location/device data collection. Account data-sharing permissions for Google products and services, modeling contributions and business insights, technical support and business recommendations are disabled.
Optional measurement is subject to the resolved privacy controls and your effective choices. Where prior consent is required, it is not required to use the core Services. Google processes Analytics information under its applicable terms and privacy information, including its Data Processing Terms for covered processing. See Google's Analytics privacy information and Google's sharing settings.
Website PostHog measurement
After affirmative measurement consent, the marketing Website uses PostHog EU Cloud to count pageviews and clicks indicating interest in starting a trial or speaking with the founder. These clicks are not confirmed registrations, bookings or revenue. Events contain controlled page information and approved Source, Medium, Campaign, Placement and Asset values where available, with a status describing missing attribution. Raw URL queries, fragments, unsafe referrers, page or form content and account or Workspace identities are excluded.
This Website setup does not store analytics cookies or visitor IDs in local or session storage, create identified person profiles, or enable session replay or advertising pixels. PostHog processes the request IP address and browser user-agent to generate a daily server-side identifier for approximate counts, then removes raw IP and user-agent values from the stored analytics events. This does not mean those values are never transmitted or temporarily processed during ingestion. Counts can change across days or merge visitors with similar inputs; they do not reliably identify individuals across devices or visits. See PostHog's cookieless tracking information.
Website measurement stays off until you agree everywhere, including when a regional policy would otherwise permit an opt-out model. Active Global Privacy Control (GPC) and Do Not Track (DNT) stop it. GPC refusal remains remembered until you make an explicit new choice after the signal is off; DNT alone is not stored as a permanent refusal. Withdrawal drops unsent events and cancels supported in-flight work. Requests already dispatched while permitted may still complete. These Website controls do not by themselves change the Platform's regional admission rules; shared refusals also stop Platform measurement. Future Platform PostHog product analytics is separate from this setup.
Your choices, browser signals and expiry
Use the Cookies or privacy-controls link on our website or application to review and change optional measurement choices. Withdrawing measurement permission affects subsequent collection; it does not automatically erase information already collected. You can also remove cookies or block them through your browser. Blocking necessary authentication or security mechanisms can prevent the requested features from working.
Our measurement controls are designed to keep optional measurement denied when a recognized Global Privacy Control signal applies, including the broader measurement-denial approach reflected in our controls. Other browser signals, such as Do Not Track, are not treated as a substitute for the available privacy choices. Necessary security and service processing continue where lawfully required.
Our main browser consent-preference cookie is configured to expire 180 days after it is written. A separate cookie used to remember US privacy and universal-opt-out decisions is configured to expire 400 days after it is written. Saving or refreshing a record can renew its period. Browser settings, clearing storage or a change to the relevant privacy configuration may remove or invalidate it sooner. Local browser storage also caches preferences; on our shared-domain sites it does not authorize measurement independently of the corresponding shared cookie. Hosted consent receipts are separate records with the retention criteria described in Section 8.
Google documents a default lifetime of two years for its _ga and _ga_* cookies, which can be renewed by subsequent visits. Analytics settings and browser limits can change that lifetime; the configured browser expiry and your removal or withdrawal of permission determine how long a particular identifier remains. See Google’s cookie information. The Analytics server-side retention periods in Section 8 do not state a browser-cookie lifetime. You can remove these identifiers through your browser or withdraw optional measurement through our controls. Contact us for information about a relevant stored preference or identifier. External booking, form and customer-selected integration websites have their own cookies and controls.
11. Security and children
We use technical and organizational safeguards designed to protect information and limit access appropriately. Security measures do not make any system completely secure. Protect your account and integration permissions, avoid exposing credentials in ordinary content, and report suspected unauthorized access to security@typenode.ai.
The Services are intended for adult business users and are not directed to children. Users must be at least eighteen under our Terms. We do not knowingly solicit personal information from children for their use of the Services. If you believe a child has supplied information or a Customer has submitted prohibited children's information, contact privacy@typenode.ai so we can investigate and take the appropriate action. An age rule does not remove duties arising when children's information is actually received.
12. Changes to this policy
We will post the current policy with its version and effective date. For material changes affecting how we process personal information, we will provide an appropriate notice, such as a notice in the Services or an email where available. We will obtain additional consent where required rather than treating continued use as consent to every new purpose. Contact privacy@typenode.ai with questions or requests.
Subprocessors and other service providers
Inventory date: 12 October 2026. This separately titled section is part of the Privacy Policy at Privacy Policy. “Subprocessor” means a supplier that processes personal data on Typenode's behalf in providing customer-instructed services. The customer Data Processing Agreement at Data Processing Agreement governs authorisation, change notices, objections and Typenode's responsibility. A vendor can have different roles for different processing.
Customer-service subprocessors
| Supplier | Processing for customer services | Relevant personal-data categories | Location and access |
|---|---|---|---|
| Cloudflare, Inc. | API/MCP hosting and networking; managed workflow execution; runtime storage, queues and execution payloads; operational diagnostics; invitation delivery where instructed for a Workspace | Workflow and integration data processed in the hosted runtime; encrypted credential material; run inputs/outputs/history; Member invitation contact details; request, security and operational identifiers/metadata | Global infrastructure and processing; not an EU-only service commitment. |
| Supabase Pte. Ltd. | Hosted database and authentication; Workspace, Member, authorisation and workflow metadata; service administration on Customer instructions | Member identity and access details; Workspace/configuration metadata; supported personal data in stored Customer records and processing evidence | Principal project storage region: Frankfurt, Germany (eu-central-1). Supplier operations, support and onward processing can involve other countries. |
| Vercel Inc. | Hosting the platform interface and relevant frontend/server operations | Request and operational metadata; personal data handled by hosted interface/server operations as necessary to provide the Customer's service | Global infrastructure and supplier operations, including the United States. The Supabase database region does not determine Vercel's processing location. |
| Resend / Plus Five Five, Inc. | Delivery of transactional Workspace or Member communications to the extent performed on Customer instructions | Recipient contact details, message content and relevant delivery metadata; no general access to workflow payloads is implied by email delivery | Primary processing operations in the United States, with supplier and onward-processing arrangements described in its DPA and provider inventory. |
| Grafana Labs | Existing operational log/trace destination for deployed services | Linkable request, tenant, execution and correlation identifiers, diagnostic outcomes and provider-generated request metadata; not a representation that all workflow payloads are exported | Configured export host is in Grafana's prod-eu-west-2 endpoint family. Endpoint naming does not establish the full processing, storage, support or onward-access location. |
Suppliers' own downstream providers are governed through the applicable supplier processing arrangements. Their published inventories provide additional details: Cloudflare, Supabase, Vercel, Resend, Grafana. Those links do not by themselves establish a binding contract, Customer approval of an unnotified material change, or an independently verified supplier guarantee.
Providers for Typenode's own activities
The following are disclosed separately because the identified processing concerns Typenode's own website, accounts, billing or prospective-customer activities. Inclusion here does not label each provider an independent controller for every purpose or a subprocessor of customer workflow content.
| Provider | Activity and role boundary | Relevant location information |
|---|---|---|
| Inth / Consent Management Inc. | Hosted consent-policy resolution and durable preference records for Typenode's website and platform. Typenode determines those preference-record purposes; Inth's processing-contract evidence is separate from the customer workflow DPA | Current production/staging runtime region Frankfurt. Other processing and onward access are not established as EU-only. |
| Google Workspace for business email and documents; Google sign-in and connected-product authorisation where selected; optional Google Analytics measurement of the Platform application. Analytics is a Typenode-controller activity; customer-directed connected Google products have their own recipient relationship | Google processing can involve the United States and other countries. | |
| Resend / Plus Five Five, Inc. | Typenode account, security and other transactional email; contact details, message content and delivery metadata. Customer-instructed messages are separately covered above | Primary processing operations in the United States. |
| PostHog | Website pageviews, curated CTA intents and approved marketing attribution after consent, with cookieless server-side counting. Future Platform product analytics is planned. This is separate from processing workflow content on Customer instructions | The Website project uses EU Cloud hosting. Supplier operations and applicable international transfers remain governed by the service arrangements; exclusive EU access is not represented here. |
| Attio and Instantly | Business-contact management and outreach for Typenode's own relationships; relevant contact, professional, consent, outreach and response records | International processing under each provider's applicable service arrangements. |
| Apify | Research and enrichment for Typenode's own prospecting; relevant business-contact and professional-profile information. Customers who choose Apify for their Workflows connect their own accounts; those connections are customer-selected recipients | Processing depends on the selected Actor, infrastructure and any external services it uses; a common platform does not establish identical access or locations for every Actor. |
| OpenAI and Anthropic | Internal business tasks, experiments and assistance with support or other communications; information supplied for those tasks. The product, account and actual processing purpose determine the applicable role; support involving Customer Personal Data remains subject to the customer DPA | International processing, including the United States, under the applicable product terms, settings and safeguards. |
| Puzzle and Mercury | Typenode's accounting, banking and financial administration; relevant contact, billing and transaction information supplied for those purposes. Independent financial or legal duties differ from customer-instructed workflow processing | Provider and financial-service processing can involve the United States and other countries. |
| Quo, where used | Business calls and associated contact and call metadata; not a statement that every call is recorded or transcribed | International processing under the applicable communications service arrangements. |
| Stripe | Payments, subscriptions and billing. Stripe's instructed processing and independent fraud, regulatory and other payment purposes differ; the customer workflow DPA does not govern all payment processing | International processing, including the United States and relevant affiliates. |
| Tally | Prospective-customer/waitlist intake selected through a separate form | Hosted form processing under its applicable terms; its DPA provides EEA transfer safeguards. |
| Cal.com | Meeting booking and associated contact/scheduling information | International processing, including the United States, under the relevant booking arrangements. |
| Cloudflare, Supabase and Vercel | Also process data for Typenode's own properties, account administration and security where Typenode determines the purposes | Locations as described above; processing role depends on the actual activity. |
Customer-selected MCP clients, AI applications and workflow destination services are not automatically Typenode's Subprocessors. Customers choose and authorise them and should review their terms and privacy settings. Typenode currently offers MCP access rather than a built-in first-party AI chat builder. The OpenAI and Anthropic disclosures above concern Typenode's internal uses, which are separate from a Customer's chosen AI client. Where any business-use provider processes Customer Personal Data on our behalf for authorised customer support or another instructed service, the DPA's subprocessor, confidentiality and transfer obligations apply to that processing regardless of the table heading.
For processing details, safeguards, supplier-change objections or questions about this inventory, contact privacy@typenode.ai. Identified principal storage/runtime regions do not promise exclusive residence in that country or eliminate international-transfer obligations.