Subprocessors

Active in this deployment (3)

• Cloudflare, Inc.

  Redacted bill figures pass through in transit

  Purpose

  Hosting the website, the installable app and the stateless functions that run the checks; delivering our emails (a subscriber’s sign-in link, the link of an organization’s plan when its buyer asks for it again, and Support-page messages to our support mailbox); forwarding the emails you send to our addresses to that mailbox

  Data received

  Requests in transit. When you ask for the checks on a bill (the free preview or the full list), the figures read from it pass through Cloudflare to our function, are processed in memory and are not written anywhere: the charges with their descriptions, codes, dates, amounts and billing organizations; the bill’s type, totals, dates, currency and number of pages; the page and line each figure came from, how sure the reading was and notes on it; whether the bill shows a provider, insurer, statement or claim number, sent only as “present”; any answers to the money questions; the country; and, for the full list, the receipt or pass. The browser removes names, addresses and account numbers wherever it recognizes them. Never the bill file, never a page image. For email, Cloudflare receives a subscriber’s email address and the sign-in link sent to it, the email address an organization’s buyer types to get the plan link again and the link sent to that address (never bill contents), the text of a Support-page message (with the email you paid with, if you gave it) on its way to our support mailbox, and each email you send to one of our addresses, which it forwards to that mailbox. Our functions log the method, path, status and duration of each request, and the step’s name for a successful free check, full list, checkout started or payment confirmed, and, when a free-access link we gave an organization is used, that organization’s name (never the code in the link); never what was sent. When a web browser opens a page, our function also writes one count line to Cloudflare’s analytics store: the page’s path, whether it is a public page or part of the app, the country, the referring website’s host name and the day, with the time our host adds when it writes the line; never the network address, the user agent or anything about a bill. Cloudflare’s own request records can include the network address a request came from. If a page fails to load, a browser may send Cloudflare a short network error report: the address that failed, the page it came from, the kind of failure and when it happened.

  Processing location

  Global network: each request is handled in the Cloudflare location nearest to the visitor, which can be outside the European Union

  Transfer basis

  EU Standard Contractual Clauses under Cloudflare’s data processing addendum

  Data processing agreement

  Cloudflare’s customer data processing addendum

  Retention

  Nothing from a request body is stored. Request records for up to about 7 days, page-visit count lines for about 3 months, and a delivery record of each email (sender, recipient, subject, time) for up to about 30 days, per Cloudflare’s retention

• Stripe Payments Europe, Ltd., and Sold through Link, LLC (Link) for purchases sold through Link

  Purpose

  Taking payment for a single bill, a Pro subscription or an organization’s yearly plan, which renews until cancelled. When Link is switched on, Link (Sold through Link, LLC, a Stripe company) is the merchant of record and handles the sale for us: it also calculates and pays sales tax and VAT in the countries it covers, and uses the payment data for its own purposes as its own controller, under its own privacy policy. Hosting checkout and the billing portal; the only record of who has paid

  Data received

  Email address, name and billing address (to work out the tax; an organization also gives its name), payment method details you enter directly with Stripe, what you bought and when, subscription state, and the ticks you gave before paying (the renewal tick and, where asked, the EU 14-day acknowledgement), which we record with the payment. For an organization’s plan we also record with the payment a neutral number for its link, the plan, the version of the Terms for organizations it accepted, the time it ticked, and its statement that it is not a health care provider, health plan or health care clearinghouse. No bill contents, no health information. For a single-bill purchase Stripe also holds a hash of the redacted figures (so the receipt can be matched to that bill), which reveals nothing about the bill itself.

  Processing location

  Ireland and United States

  Transfer basis

  EU Standard Contractual Clauses under Stripe’s data processing agreement

  Data processing agreement

  Stripe’s DPA is incorporated in its services agreement

  Retention

  Per Stripe’s retention policy for payment records

• Proton AG

  Purpose

  Hosting our support mailbox. Cloudflare forwards to it each message sent from the Support page or with Tell us how it went, and each email you send to one of our addresses.

  Data received

  What you wrote in a message or an email, the topic you chose, the app version, and your email address if you gave it. We ask you not to include anything from your bill. A message may still say something about your health.

  Processing location

  Switzerland

  Transfer basis

  European Commission adequacy decision for Switzerland

  Data processing agreement

  Proton’s data processing agreement is part of its terms

  Retention

  Up to 12 months after the matter a message raised is closed, or until you ask us to delete yours

Not in use in this deployment

Supported by the software but not currently configured, so they receive nothing.

• ResendAlternative email provider for sign-in links (not used in production)
• Functional Software, Inc. (Sentry)Error tracking (optional)