Subprocessors

A subprocessor is a third party that Fauna engages to process personal data while providing Cohie. Cohie uses the following subprocessors.

Cloudflare, Inc.

• Headquarters: USA
• Service: application hosting (Workers), database (D1), file storage (R2), bot protection (Turnstile), cookieless visit measurement on the root domain's public pages (Web Analytics), network and domain services
• Data processed: platform data (account, program, application, files); for Turnstile, the visitor's IP address and browser signals; for Web Analytics, the address of the page opened, the referring page, browser and device type, load time and the country derived from the IP address
• Data location: The database is within the European Union jurisdiction. By default, files are kept in storage created in Europe; that storage is not bound to the EU jurisdiction. On the Enterprise plan an organization can choose to keep its files in storage within the EU jurisdiction. Details are below in "Where data is kept".
• Transfer basis: KVKK art. 9

Resend, Inc.

• Headquarters: USA
• Service: transactional email (application received, decision, invitation, password reset, address verification)
• Data processed: the recipient's email address, the subject and content of the email
• Data location: Resend's email infrastructure (including the USA)
• Transfer basis: KVKK art. 9

Anthropic, PBC

• Used: only on the Enterprise plan and only when the organization turns on the AI features (AI application summaries, AI program assistant). While they are off, no data is sent
• Headquarters: USA
• Service: text summaries and answers to questions with an AI model
• Data processed: application answers not marked as personal; questions typed to the assistant and the program's own content. Personal fields, the applicant's identity and files are not sent
• Data location: Anthropic's infrastructure (including the USA)
• Transfer basis: KVKK art. 9. When the organization turns a feature on, a related item is added to the privacy notice for applicants

Services an organization connects

These are not subprocessors that Fauna engages. An organization connects them by its own decision, or a visitor connects to them by their own choice. They are listed here for transparency; the organization also mentions them in its own privacy notice.

• The organization's email infrastructure: On the Enterprise plan, if the organization connects its own sending infrastructure (SMTP, Postmark, SendGrid, Amazon SES or Microsoft 365), its emails are sent through it. The recipient's email address and the subject and content of the email go to that provider.
• Single sign-on (SSO): If the organization connects its own identity provider, users are redirected to that provider when they sign in. The provider returns the user ID and email address.
• Social media posting: On the Enterprise plan, if the organization connects a LinkedIn, X, Facebook or Instagram account, the post text and image the organization writes are sent to that platform. The account's access token is stored encrypted on Cohie.
• Webhooks: On the Enterprise plan, if the organization sets a webhook address, event notifications are sent to it. Notifications carry IDs and statuses, not names or email addresses.
• YouTube (Google LLC) and Vimeo, Inc. (USA): Used only on the Enterprise plan, when an organization has added a video to its custom page and the visitor presses "Play video". Cookie-free embed addresses are used (youtube-nocookie.com, player.vimeo.com). Nothing is sent to the provider while the page loads or before play, and no thumbnail is fetched. On play, the visitor's browser connects to the provider directly; the IP address and browser details go to the provider, and Cohie does not receive them. The basis is the visitor choosing to play (a notice is shown on the cover).

Where data is kept

This section is the annex to the transfer information referred to in section 9 of the Data Processing Agreement. The Data location screen in organization admin shows the same information with the organization's current choice.

• Database records (accounts, application answers, scores and comments, messages, notifications, audit log): Cloudflare D1, one database shared by all organizations. It is within the European Union jurisdiction; records are not stored outside the EU. An organization's data location choice does not change the database.
• Files (application documents, deliverables, logos and images, report outputs, the full export archive): Cloudflare R2. The default storage was created in Europe but is not bound to the EU jurisdiction. On the Enterprise plan an organization can choose storage within the EU jurisdiction; files in that storage are not stored outside the EU. Files are delivered to the person who opens them over Cloudflare's network.
• Database backups: Cloudflare R2, a separate bucket. It was created in Europe but is not bound to the EU jurisdiction. Weekly, encrypted, kept for 90 days at most.
• Sending email: Resend (including the USA); the organization's own provider if it has connected its own email infrastructure on the Enterprise plan.
• AI features: Anthropic (including the USA), only on the Enterprise plan and only if the organization turned them on.
• Video playback: YouTube (Google) or Vimeo (including the USA), only if an organization has put a video on its page and the visitor chooses to play it.
• Network and application logs: Cloudflare's global network.

If the database also has to be kept in a specific country (for example Türkiye), the organization sends a regional deployment request from the Data location screen. The scope and timing of such a deployment are set out in a separate agreement; the request alone does not move any data.

Changes

If the list changes, this page is updated and the organization's owners and admins are notified by email at least 30 days in advance. The right to object is in section 7 of the Data Processing Agreement.