Sub-processors
Last updated 28 July 2026 · Version 1.0
To run Narutai we engage a limited number of suppliers. They are named below, with what they do, where they do it, and the safeguard any transfer outside the EEA rests on.
We name them rather than listing "categories of recipients", because a category tells you nothing.
In case of doubt, the Dutch text prevails.
1. Suppliers that process on our behalf
| Supplier | Role | Service | Country of processing | Safeguard | Which data |
|---|---|---|---|---|---|
| Supabase (Supabase Pte. Ltd.) | Processor | Database, user authentication and document storage | Database and documents in Germany (Frankfurt); contracting entity in Singapore, with logs and some supporting services outside the EU | Standard contractual clauses (Decision 2021/914, module 2). Supabase does not participate in the Data Privacy Framework. | All data you record in Narutai, including documents |
| Vercel | Processor | Hosting of the application and background jobs | Germany (Frankfurt) for the application; builds and deploys from the US | EU-US Data Privacy Framework, supplemented by standard contractual clauses (Decision 2021/914) | Data passing through the application, plus technical logs |
| Anthropic (Anthropic Ireland, Limited) | Processor | AI model (Claude) for document extraction, booking proposals and the assistant | Contracting entity in Ireland; the processing itself takes place in the United States | Standard contractual clauses (Decision 2021/914, module 2). Anthropic does not participate in the Data Privacy Framework and does not train models on our content. | The content of the document, message or request you have processed |
| Resend | Processor | Sending and receiving email on your behalf and on ours | United States | EU-US Data Privacy Framework (for non-HR data), supplemented by standard contractual clauses (Decision 2021/914, module 2) | Sender, recipients, subject, content and attachments of the message |
| Mollie B.V. | Independent controller | Payments and subscription collection | The Netherlands (Amsterdam) | Dutch company supervised by the Dutch central bank; where Mollie itself processes outside the EEA, it uses standard contractual clauses | Name, email address, payment details and amounts |
| Microsoft | Processor | Connection to OneDrive and to your Microsoft mailbox — only if you set it up | European Union — Microsoft keeps customer data within the EU Data Boundary | Processing within the EU; should data nevertheless leave: EU-US Data Privacy Framework and standard contractual clauses | The files in the Narutai folder and the messages in the connected mailbox |
| Dropbox | Processor | Connection to your Dropbox — only if you set it up | United States | EU-US Data Privacy Framework (Dropbox, Inc. appears on the official list) | The files in the Narutai folder |
| Google LLC | Processor | Connection to Google Drive — only if you set it up | United States | EU-US Data Privacy Framework, supplemented by standard contractual clauses | The files you select |
A supplier tied to a connection — OneDrive, Dropbox, Google Drive — only receives data if you set that connection up yourself. If you do not, that supplier plays no part for you.
2. Bank and broker connections
These parties only come into play if you connect a bank or investment account. A bank connection always runs through a party licensed under PSD2; Narutai itself has no access to your bank.
| Supplier | Role | Service | Country of processing | Safeguard | Which data |
|---|---|---|---|---|---|
| Salt Edge | Account information service provider (PSD2) | Bank connection | Data of users in the EEA is stored in the EU (Germany, Finland, Ireland); the group includes companies in Czechia, Canada and the United Kingdom | Storage within the EU; the group companies outside the EU are covered by the European Commission's adequacy decisions for Canada and the United Kingdom | Account details, balances and transactions for the account you release |
| GoCardless SAS (Bank Account Data) | Account information service provider (PSD2), authorised by the French regulator | Bank connection | France and the Netherlands; part of the processing takes place in the United Kingdom | Processing within the EEA; the UK part is covered by the adequacy decision for the United Kingdom | Account details, balances and transactions for the account you release |
| Tink | Account information service provider (PSD2) | Bank connection | Sweden | Not applicable — processing within the EEA | Account details, balances and transactions for the account you release |
| Yapily (Yapily Connect UAB) | Account information service provider (PSD2), authorised by the Lithuanian central bank | Bank connection | Lithuania | Not applicable — processing within the EEA | Account details, balances and transactions for the account you release |
| Interactive Brokers Ireland Limited | Independent controller | Retrieving your securities positions and trades — only if you set it up | Ireland | Not applicable — processing within the EEA | Account number, positions, trades and cash flows |
3. If you use your own AI key
You can enter your own Anthropic or OpenAI API key in the settings. If you do, AI requests go to your account with that provider, under the terms you agreed with them. OpenAI is therefore not in the table above: that party is involved solely through your own choice and on your own contract.
4. Components your browser fetches from a third party
These parties receive nothing from our servers. Your browser fetches a component directly from them, which is how they see your IP address. We name them because it happens, not because we have agreements with them — we do not.
| Supplier | Role | Service | Country of processing | Safeguard | Which data |
|---|---|---|---|---|---|
| TradingView | Independent third party | Price chart on a security's detail page | United States | Not a Data Privacy Framework participant. We have no agreement with TradingView; TradingView's own terms apply to this chart. | Your IP address, the requested symbol and your use of the chart; TradingView can set its own cookies |
| Independent third party | The picker you use to select files from Google Drive — only if you use that button | United States | EU-US Data Privacy Framework | Your IP address | |
| Clearbit | Independent third party | Bank and broker logos in the selection screen | United States | No agreement; we merely load an image. We are replacing this with locally hosted images. | Your IP address |
The TradingView price chart is the weightiest of these: it is a complete component that TradingView loads itself and that can set its own cookies. See the cookie statement as well.
5. Public registers we query
These parties are not processors: we ask them a question and get an answer back. We send an address, an identifier or a number — never a file or an overview of your wealth.
| Supplier | Role | Service | Country of processing | Safeguard | Which data |
|---|---|---|---|---|---|
| Kadaster (BAG, WOZ-waardeloket) | Public register | WOZ valuation, construction year and floor area for an address | The Netherlands | Not applicable — processing within the EEA | An address or BAG identifier |
| PDOK | Public register | Looking up and completing addresses | The Netherlands | Not applicable — processing within the EEA | An address or postcode |
| EP-Online (RVO) | Public register | Energy label for an address | The Netherlands | Not applicable — processing within the EEA | An address |
| Yahoo Finance | External source | Current prices and company data for a security | United States | No agreement; we query a public price service. We send only ticker symbols — no name and no quantities. | The ticker symbols of the securities a price is fetched for |
| VIES (Europese Commissie) | Public register | Validating a contact's VAT ID | European Union | Not applicable — processing within the EEA | A VAT ID |
6. Changes to this list
This list is current as at the date shown at the top of this page. If a supplier is added or removed, we update the list and increment the version number. We notify you actively of a new supplier processing your data before the change takes effect, by email or in the application. Questions can be sent to privacy@narutai.com.