Sub-processors
Everyone outside us who can see data from TheJay, and why that is.
This list belongs to the Data Processing Agreement and the privacy statement. If a party is added, we give at least 30 days' notice by email and you may object.
In use today
| Party | For what | Which data | Where |
|---|---|---|---|
| Nodge hosting |
Running the application, the database — which also holds the files you upload — and backups | Everything in TheJay, including your uploaded files | The Netherlands (EU), on servers of LeaseWeb Netherlands B.V. |
| AhaSend B.V. mail relay |
Sending TheJay's own mail: sign-in and confirmation codes, receipts, invitations to join TheJay, account, billing and security mail, and notices to members about their own workspace; and, for a member and with their confirmed address to reply to, an organiser's request for information, its reminders, a change on the night and a message to the lineup, to people who have no account. Other mail a member writes leaves from their own mailbox, never through this relay. Also receiving mail sent to TheJay support, and replies to it, and handing it to TheJay as the messages of a support request | The recipient's email address and name, and the content of that mail; for mail to support, the sender's address and name, the subject and the text | The Netherlands (EU) |
| OpenAI AI |
Writing and reading with the AI features — a caption, an email, a reading of a contract, an answer from the assistant — and turning a voice note into text. Only when you use one of those features | What that one request needs: the context of that post, release or question; the contract you ask it to read; the recording you made. OpenAI does not train its models on it. It keeps a request for up to 30 days to detect abuse. A contract you have had read is stored there as a file, so it is not uploaded again, for seven days at most — sooner gone when the document is deleted, its workspace cleared or the account that uploaded it erased | United States |
| Apple iPhone notifications |
Delivering notifications to the TheJay app on an iPhone, through the Apple Push Notification service (APNs). Only if you allowed notifications | The phone's push token, and the notification: a short title, which can name your artist name or workspace, one general line and a link — never the content of a message, a booking or a contract | United States |
| Google Android notifications |
Delivering notifications to the TheJay app on Android, through Firebase Cloud Messaging (FCM). Only if you allowed notifications | The phone's push token, and the notification: a short title, which can name your artist name or workspace, one general line and a link — never the content of a message, a booking or a contract | United States |
About AI. Nothing goes to an AI provider unless you use an AI feature: you press the button to have text written, ask the assistant, have a contract read, or record a voice note. What goes is what that one request needs — not your whole network, not your music files. If you do not use one, this never happens; most features also have a variant that composes the text without a model.
Transfers outside the EEA
OpenAI processes outside the EEA, and so may Apple and Google when they deliver a notification to your phone. For OpenAI, the European Commission's Standard Contractual Clauses apply, together with OpenAI's own data processing terms. For Apple and Google, the transfer rests on the safeguards in their own terms. The others in the table above stay inside the EU.
Present in the product, but not in use
The following is in the software but not switched on in production today. No data goes to it.
- Mollie B.V. (The Netherlands, EU) — payments. No key is configured, so nothing can be bought or paid through TheJay and nothing goes to Mollie. When TheJay offers a checkout, Mollie charges plans, add-ons and AI credit and collects payments made through TheJay, and receives your name, email address, the amount and the payment details.
- Object storage (S3) — for large files. Not configured: every file you upload is stored in TheJay's own database at the hosting provider above, with a 12 MB per-file limit, and no storage provider receives it. If this is switched on, your browser uploads straight to that storage, and its provider is added to the table above first.
- Unsplash — stock photographs in the Content Studio. No key is configured, so photo search is off. When it is on, only the words you type into the search go from our server to Unsplash; your browser then loads the photos it shows straight from Unsplash, which sees your IP address as any website does. A photo you use is copied into your workspace.
If we switch any of these on, it moves into the table at the top first and you get 30 days' notice.
What are not sub-processors
Social platforms you publish to
When you publish from TheJay, you give that instruction and the post goes straight to the platform, through your own connected account. The platform is then a recipient on your instruction, not our sub-processor; what it does with it is in its own terms. Each platform can be connected only once it has approved TheJay — until then nothing goes to it — and under Integrations you see which you can connect. What TheJay reads and keeps of each platform, and how to have it deleted, is in the privacy statement, section 7.
| Platform | What it receives, on your instruction | Where |
|---|---|---|
| Instagram and Facebook Meta Platforms Ireland Limited |
The pictures or the video and the text of the post you chose. On Instagram a professional account; on Facebook TheJay posts as your Page, never as you personally | Ireland (EU); Meta may also process outside the EEA |
| YouTube Google — the YouTube API Services, by Google LLC |
The video of your post, with the title and the description | United States |
| TikTok TikTok Technology Limited |
The video or the photos and the caption you chose, with the privacy and interaction settings you chose | Ireland (EU); TikTok may also process outside the EEA |
| LinkedIn no longer offered |
Nothing: you cannot connect it and TheJay posts nothing there any more | — |
Your browser's push service
If you allow notifications in a browser on a computer, they travel through the push service of whoever made that browser — Google for Chrome, Mozilla for Firefox, Apple for Safari, Microsoft for Edge. The content is encrypted for your browser, so that service cannot read it.
People you send a link to
When you send a demo or release link, you decide who gets it. If you send it from TheJay, it leaves from your own mailbox (see the privacy statement, section 3); otherwise we do not see who you sent it to, unless you record the recipient in TheJay yourself.