Sub-processors
Last updated: 22 August 2026
We use the following processors to operate Sapyora. Each processes personal data on our behalf under a data processing agreement. Transfers outside the EU/EEA rely on appropriate safeguards (EU-US Data Privacy Framework and/or Standard Contractual Clauses).
Supabase
Purpose: database & authentication.
Region: EU (Frankfurt).
Transfer outside EU/EEA: no.
Google (Gemini API)
Purpose: AI processing of transcripts and article content.
Region: United States.
Transfer outside EU/EEA: yes — SCC / Data Privacy Framework.
OpenAI (OpenAI Ireland Ltd. / OpenAI OpCo, LLC)
Purpose: generating articles from transcripts or user-supplied materials.
Region: United States; OpenAI Ireland Ltd. is the contractual entity for customers established in the EEA.
Safeguards: EU-US Data Privacy Framework where applicable and Standard Contractual Clauses in the DPA; API inputs and outputs are not used to train models by default.
Lemon Squeezy
Purpose: payments, as Merchant of Record.
Region: United States.
Transfer outside EU/EEA: yes — SCC / Data Privacy Framework.
Vercel
Purpose: web hosting and content delivery.
Region: global edge network.
Transfer outside EU/EEA: possible — SCC / Data Privacy Framework.
Fly.io
Purpose: processing workers.
Region: EU (Amsterdam).
Transfer outside EU/EEA: no.
Sentry
Purpose: error monitoring.
Region: EU (Germany).
Transfer outside EU/EEA: no.
PostHog
Purpose: product analytics (only with your consent).
Region: EU.
Transfer outside EU/EEA: no.
Resend
Purpose: transactional email.
Region: United States.
Transfer outside EU/EEA: yes — SCC / Data Privacy Framework.
Cloudflare
Purpose: DNS and network protection.
Region: global.
Transfer outside EU/EEA: possible — SCC / Data Privacy Framework.
Webshare
Purpose: proxy network used to fetch YouTube data technically available without user credentials.
No account credentials, cookies or other account personal data are sent — request routing only.