Sub-processors
Last updated
These are the third-party services that process personal data to run podswitch, what each one does, where it holds data and the legal mechanism for any transfer outside the UK. We require each of them, by contract, to protect personal data and use it only on our instructions. We will update this page before adding or replacing a provider.
Current sub-processors
| Provider | Purpose | Personal data involved | Data location | Transfer mechanism |
|---|---|---|---|---|
| Supabase | Database, sign-in and file storage | Account and project details, uploaded audio and outputs | EU region | Storage in the EU: UK adequacy regulations for the EU. Access by Supabase, Inc. in the US: the UK Addendum to the EU Standard Contractual Clauses, in the provider’s data processing agreement |
| Vercel | Website and application hosting | Requests to the site, including IP addresses | Functions configured to run in an EU region | In the EU: UK adequacy regulations for the EU. Vercel Inc. in the US: the UK Extension to the EU-US Data Privacy Framework (UK-US data bridge), and the UK Addendum to the EU Standard Contractual Clauses in Vercel’s data processing agreement for any transfer the certification does not cover |
| Trigger.dev | Background processing of recordings | Uploaded audio and project settings while a project is processed | Trigger.dev’s default cloud region (no specific region is selected) | The UK Addendum to the EU Standard Contractual Clauses, in the provider’s data processing agreement (Trigger.dev is run by API Hero Ltd, a UK company, which covers its own hosting providers) |
| Resend | Sending email | Email address and message content | EU | In the EU: UK adequacy regulations for the EU. Resend in the US: the UK Extension to the EU-US Data Privacy Framework (UK-US data bridge) |
| Stripe | Payments and subscriptions | Billing details, email address, payment card details (held by Stripe) | US, and other countries where Stripe operates | The UK Extension to the EU-US Data Privacy Framework (UK-US data bridge); Stripe, LLC is certified |
| Google (Google Analytics 4) | Website and product analytics, only with your consent | Pages visited with IDs removed, events, device and approximate location | US | The UK Extension to the EU-US Data Privacy Framework (UK-US data bridge); Google LLC is certified |
| Sentry | Error monitoring | Error reports and technical data; names, emails, file names, folder paths and tokens are excluded | EU data region | In the EU: UK adequacy regulations for the EU. Functional Software, Inc. (Sentry) in the US: the UK Extension to the EU-US Data Privacy Framework (UK-US data bridge) |
| Cloudflare | Bot checks (Turnstile) for the free trial | IP address and browser signals | Cloudflare’s global network, including the US | The UK Extension to the EU-US Data Privacy Framework (UK-US data bridge); Cloudflare, Inc. is certified |
| Slack | Internal notifications to our team (new accounts, purchases, downloads, support requests, partner enquiries) | Email address, and project names, the support message or the partner enquiry where relevant | UK | None needed: the data is held in the UK |
| AssemblyAI | Transcribing recordings for social clips (paid plans) | The project’s audio mix while it is transcribed, and the transcript | EU (AssemblyAI’s EU endpoint) | In the EU: UK adequacy regulations for the EU. AssemblyAI, Inc. in the US: the UK Addendum to the EU Standard Contractual Clauses, in the provider’s data processing agreement |
| Anthropic | Choosing social clips from a transcript (paid plans), suggesting background music ideas from it (MAX plan), and writing social post text for a clip or episode when you ask (MAX plan) | Transcript text and the speaker names you entered (for music ideas, transcript text only, with speakers shown as “Speaker 1”, “Speaker 2”); for post text, also the clip’s title and the episode notes | US | The UK Addendum to the EU Standard Contractual Clauses, in the provider’s data processing agreement |
| Google (Gemini API, paid service) | Making background music with Google’s Lyria model (MAX plan), and making an AI thumbnail with Google’s Gemini image model when you ask for one (MAX plan) | For music: only a short text description of the music (genre, instruments, tempo and mood); names, email addresses, links and phone numbers are removed before it is sent. For an AI thumbnail: the still frames from your video that you select (they show the people in them), the name of the speaker in each frame, the title and your request. No audio, transcript or account details are sent for either | Google’s global infrastructure, including the US (no region is selected) | The UK Extension to the EU-US Data Privacy Framework (UK-US data bridge); Google LLC is certified. Google’s data processing terms for the paid Gemini API also apply |
What the transfer mechanism column means
Where a provider is based in, or may access data from, a country outside the UK, UK law requires a lawful basis for the transfer. For each provider we rely on one of the following, as shown in the table:
- UK adequacy regulations, where the country is recognised by the UK as providing adequate protection;
- the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), where a US provider is certified under it; or
- the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
Questions
For more about how we handle personal data, see our privacy notice or contact us at lev@metamindz.co.uk.