Sub-processors
Last updated
These are the third-party services that process personal data to run podswitch, what each one does, where it holds data and the legal mechanism for any transfer outside the UK. We require each of them, by contract, to protect personal data and use it only on our instructions. We will update this page before adding or replacing a provider.
Current sub-processors
| Provider | Purpose | Personal data involved | Data location | Transfer mechanism |
|---|---|---|---|---|
| Supabase | Database, sign-in and file storage | Account and project details, uploaded audio and outputs | EU region | To be recorded before launch |
| Vercel | Website and application hosting | Requests to the site, including IP addresses | Functions configured to run in an EU region | To be recorded before launch |
| Trigger.dev | Background processing of recordings | Uploaded audio and project settings while a project is processed | EU region, if available at setup | To be recorded before launch |
| Resend | Sending email | Email address and message content | [Resend data location, to be confirmed at setup] | To be recorded before launch |
| Stripe | Payments and subscriptions | Billing details, email address, payment card details (held by Stripe) | Under Stripe’s own terms | To be recorded before launch |
| Google (Google Analytics 4) | Website and product analytics, only with your consent | Pages visited with IDs removed, events, device and approximate location | Under Google’s terms | To be recorded before launch |
| Sentry | Error monitoring | Error reports and technical data; names, emails, file names, folder paths and tokens are excluded | EU data region | To be recorded before launch |
| Cloudflare | Bot checks (Turnstile) for the free trial | IP address and browser signals | Under Cloudflare’s terms | To be recorded before launch |
What the transfer mechanism column means
Where a provider is based in, or may access data from, a country outside the UK, UK law requires a lawful basis for the transfer. For each provider we will record one of the following before launch:
- UK adequacy regulations, where the country is recognised by the UK as providing adequate protection;
- the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), where a US provider is certified under it; or
- the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
Questions
For more about how we handle personal data, see our privacy notice or contact us at lev@metamindz.co.uk.