Sub-processors
Last updated: 1 November 2026
We rely on the providers listed below to run the service. When we process the content you upload we act as a processor on your behalf, and these providers are our sub-processors under Article 28 GDPR. This list is current and binding: if it changes, we tell you as described at the bottom of this page.
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| netcup GmbH | Servers and infrastructure | Database, processing queues and files being processed | Germany 🇩🇪 |
| Groq, Inc. | Automatic speech transcription | The audio content of the file you upload | United States 🇺🇸 |
| Together AI, Inc. | Automatic speech transcription — backup for Groq | The audio content of the file you upload | United States 🇺🇸 |
| Google Ireland Ltd. | Content generation and file safety check (Gemini) | The transcript and, for the safety check when it is active, a few frames from the video; never your account data | Ireland 🇮🇪 |
| Anthropic PBC | Content generation and file safety check (Claude) | The transcript and, for the safety check when it is active, a few frames from the video; never your account data | United States 🇺🇸 |
| DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.) | Content generation | The transcript, never your account data | China 🇨🇳 |
| NVIDIA Corporation | Content generation (backup) | The transcript, never your account data | United States 🇺🇸 |
| Moonshot AI (Kimi) | Content generation (backup) | The transcript, never your account data | China 🇨🇳 |
| Resend, Inc. | Service email delivery | Recipient address and message content | United States 🇺🇸 |
| Cloudflare, Inc. | Site delivery, anti-bot check at sign-up (Turnstile), file storage and database restore archive | Web traffic to the public pages; at sign-up with email and password, technical browser and connection signals (IP address, user agent); uploaded and generated files; database restore copies, encrypted by us before upload | European Union 🇪🇺 (storage) · global network 🌍 (delivery and anti-bot check) |
| Functional Software, Inc. (Sentry) | Error monitoring | Technical failure details and workspace identifier (pseudonym) | European Union 🇪🇺 |
| Aruba S.p.A. | Service mailboxes | Email sent from and received by our mailboxes | Italy 🇮🇹 |
Providers acting as independent controllers
These are not sub-processors: they process data for their own purposes, under their own privacy notices.
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| Stripe Payments Europe, Ltd. | Payments | Email, amounts, billing details. Card data never passes through us | Ireland 🇮🇪 |
| Google Ireland Ltd. (Analytics/Ads) | Statistics and campaign measurement | Measurement identifiers, only if you consent to cookies | Ireland 🇮🇪 |
Transfers outside the European Union
Providers located outside the EU receive data on the basis of the Standard Contractual Clauses approved by the European Commission (Articles 44 et seq. GDPR). What leaves Europe is the content you entrust to us — the audio for transcription, the text for generation, a few frames for the safety check, when it is active — never your credentials or payment details. Uploaded and generated files stay in the European Union: the database and the processing on our servers in Germany, the files in storage subject to European Union jurisdiction.
How we announce changes
Before adding or replacing a sub-processor we update this page and notify customers with a data processing agreement in place, giving at least 30 days' notice so they can object. To receive these notices or request the data processing agreement (DPA), write to privacy@echoflow.it.