These are the companies that process personal data on our behalf to run tamr. Each one sees only the data it needs for its job.
What this list is
A subprocessor is a vendor that handles personal data for us. When a restaurant uses tamr, we are its processor, and these vendors are our subprocessors under the data processing addendum. For restaurant accounts, where we are the controller, they are our processors. How we use the data is explained in our privacy policy.
Hosting and infrastructure
Data: All platform data.
Location: Amsterdam, Netherlands.
Data: All traffic passing through the network, uploaded files, encrypted backups.
Location: Global edge network, with traffic terminated at the edge nearest the visitor. R2 object storage for this account is created with an Eastern Europe (EU) location hint, and objects are stored in that region.
Safeguard: Cloudflare's Data Processing Addendum incorporating the Standard Contractual Clauses. A location hint sets where objects are stored, not a contractual residency guarantee, so we rely on the SCCs rather than on residency alone. Restaurants that need a contractual EU-only commitment for stored files should contact us before uploading.
AI and menu import
Data: Prompts, including menu content and guest messages with phone numbers and emails removed.
Location: United States.
Data: Prompts as above.
Location: The region of the Google endpoint OpenRouter routes the request to, which may be in the United States or the European Union and is chosen per request for availability.
Safeguard: Google's Cloud Data Processing Addendum with the Standard Contractual Clauses, reached through OpenRouter's processor terms. Requests are sent with data collection denied, so the prompt is not retained by the provider or used to train models. Prompts carry menu content and guest messages with phone numbers and email addresses removed. Restaurants that need model processing pinned to one region should contact us.
Data: Prompts as above.
Location: Depends on the provider endpoint OpenRouter selects.
Data: Guest audio recordings.
Location: United States.
Data: Menu documents uploaded by restaurants.
Location: France, EU.
Data: Public web pages.
Location: United States.
Data: Prompts and replies, with emails and phone numbers masked.
Location: Germany, EU.
Monitoring and analytics
Data: Error details. Cookies, headers and IP addresses are not sent by default.
Location: United States. Our account ingests to Sentry's US region (us.sentry.io).
Safeguard: Sentry's Data Processing Addendum incorporating the Standard Contractual Clauses. Session replay masks all text and input values and blocks media, and runs only with analytics consent, so replays do not carry guest conversation content.
Data: Usage events. Cookies, session replay and the visitor's IP address only with analytics consent. Replays mask all text and form inputs, so they do not carry guest conversation content.
Location: EU region.
Data: Application logs: request details including IP addresses and browser user agents, account and guest session identifiers, and error messages. Email addresses and credentials are kept out of logs. Kept for 3 days.
Location: United States.
Safeguard: Better Stack's Data Processing Addendum incorporating the Standard Contractual Clauses.
Email, payments and sign-in
Data: Email address and message content.
Location: United States.
Data: Your billing contact and the card or payment details you give Dodo directly, which do not pass through tamr.
Location: International. Dodo operates through the group entities listed in its own privacy policy and may use payment providers in several countries.
Safeguard: As merchant of record, Dodo Payments is an independent controller of the payment data it collects, not our subprocessor, and its own privacy policy governs that data. It is listed here for completeness because it is part of the billing flow. Guest data is never sent to it.
Data: Name, email address and avatar from the chosen account.
Location: United States.
Data: Emails you send us.
Location: Switzerland.
A restaurant can also add its own advertising pixels to its menu (Meta, Google, TikTok, Snap). Those are chosen and controlled by the restaurant, not by tamr, and are not listed here. See the cookies page.
International transfers
Guest data is stored in the EU, on our servers in Amsterdam. Each vendor above lists the safeguard we rely on where it sits outside the EU: in every case a signed data processing addendum incorporating the European Commission's Standard Contractual Clauses (Implementing Decision 2021/914), or the vendor's equivalent processor terms where it is established in a country with an adequacy decision. tamr itself is operated from the United Arab Emirates, and our personnel in the UAE and Lebanon access data remotely to run and support the service under the same Clauses, as described in the data processing addendum. We can provide the relevant addendum for any vendor on request.
Changes to this list
We update this page before a new subprocessor starts handling personal data, and email the account owners and administrators of every restaurant at least 30 days before the change takes effect. If you object on reasonable data protection grounds within those 30 days, the objection process in the data processing addendum applies: we look for a change that avoids the new subprocessor for your restaurant, and where we cannot, you may terminate the affected part of the service without penalty. To be told about changes at a specific security or privacy address rather than the account owners, email [email protected] and we will add it to the notice list.
Email [email protected] for a copy of our processor terms or to ask about a specific vendor.