Sub-Processor List
Last updated:24 May 2026 · Prime Construct Ltd (trading as TillTalk)
TillTalk uses the following third-party service providers (“sub-processors”) to deliver its service. Each sub-processor processes personal data only as necessary to perform the services described below and under a Data Processing Agreement (DPA) or equivalent contractual arrangement with TillTalk.
Ad platforms listed below receive hashed conversion events only when a client has authorised TillTalk to run campaigns on that platform on their behalf. See §5.2 and §10 of the Privacy Policy for details on the hashing methodology and the legal basis.
TillTalk will notify clients of any material additions to this list at least 30 days before the new sub-processor begins processing personal data, giving clients the opportunity to object. To receive notifications, ensure your account email is current.
| Service | Category | Purpose | Data processed | Region |
|---|---|---|---|---|
| Clover (Fiserv) | POS Integration | Reads transaction data on the merchant's instruction to verify ad performance | Transaction amounts, timestamps, tender type; hashed customer identifiers (email, phone, name) derived from POS records | USA |
| Twilio | Messaging Delivery | Delivers WhatsApp and SMS messages between TillTalk and clients | Phone numbers, message content (AI responses, reports, alerts) | USA |
| Anthropic | AI Processing | Powers the TillTalk AI marketing agent that answers client queries and drafts recommendations | Query content, business context, conversation history (no raw customer PII is sent to Anthropic) | USA |
| OpenAI | AI Processing (fallback) | Provides fallback AI inference for the TillTalk marketing agent when Anthropic is unavailable or for specific embedding workloads | Query content, business context, conversation history (no raw customer PII) | USA |
| Meta Platforms Ireland Ltd (Facebook / Instagram) | Ad Platform — Campaign Operation & Conversion Matching | Receives campaign operation data (campaign names, budgets, audience definitions, creative assets) via the Meta Marketing API and hashed conversion events via the Meta Conversions API (CAPI), to run and measure advertising campaigns on the client's behalf on Facebook and Instagram | Campaign metadata, budgets, audience definitions; hashed customer identifiers (email, phone, first name, last name), transaction value, transaction timestamp, event type | EU (Ireland) / USA |
| Google Ireland Ltd (Google Ads) | Ad Platform — Campaign Operation & Conversion Matching | Receives campaign operation data (campaign names, budgets, audience definitions, creative assets) via the Google Ads API and hashed conversion events via Google Enhanced Conversions, to run and measure advertising campaigns on the client's behalf across Google's advertising network | Campaign metadata, budgets, audience definitions; hashed customer identifiers (email, phone, first name, last name), transaction value, transaction timestamp | EU (Ireland) / USA |
| TikTok Technology Limited (TikTok) | Ad Platform — Campaign Operation & Conversion Matching | Receives campaign operation data (campaign names, budgets, audience definitions, creative assets) via the TikTok Marketing API and hashed conversion events via the TikTok Events API, to run and measure advertising campaigns on the client's behalf on TikTok | Campaign metadata, budgets, audience definitions; hashed customer identifiers (email, phone, first name, last name), transaction value, transaction timestamp, event type | Ireland / USA / Singapore |
| Stripe | Payment Processing | Processes subscription billing and payment management for TillTalk clients | Card tokens (not card numbers), billing contact details, subscription status | USA / EU |
| SendGrid (Twilio) | Email Delivery | Sends transactional emails (account, billing, security) and marketing emails on TillTalk's behalf | Email addresses, names, email content | USA |
| Supabase | Database, Authentication & File Storage | Stores client account data, encrypted POS credentials, and operational data; handles client authentication | Account data (name, email, business details), encrypted POS credentials, operational records | EU (Ireland) |
| Railway | Application Hosting & Compute | Runs the TillTalk backend service and AI agent infrastructure | All application data passing through the TillTalk backend, including client data and hashed transaction data | USA |
| Vercel | Website Hosting | Serves tilltalk.ie, the client dashboard, and all public-facing web pages | Website traffic, session tokens, page requests | Global CDN (data processed in USA) |
| Sentry | Application Error Monitoring | Captures application errors and performance traces from the TillTalk backend and website to detect and resolve faults | Error stack traces, request context, sanitised application logs (no raw PII; access tokens redacted at source) | EU (Frankfurt) — Sentry EU instance |
International transfers
Several sub-processors are based in the United States. Where personal data is transferred outside the European Economic Area, TillTalk relies on EU Standard Contractual Clauses and, where applicable, adequacy decisions such as the EU–US Data Privacy Framework.
Clover-specific processing
Merchants using TillTalk's Clover integration may review our Clover Privacy Addendum for additional detail on how data received from Clover is handled.
Questions
To request copies of the DPAs in place with any sub-processor, or to raise an objection to the addition of a new sub-processor, contact daniel@tilltalk.ie.
This list is maintained by Prime Construct Ltd (registered in Ireland, company number 751535). Privacy Policy · Terms of Service