Legal

Sub-processors

Version 1.4, effective 15 October 2026 · History

In short

  • These are the only companies that process personal data for InksForm.
  • Planned ones are listed here at least 30 days before they start. Subscribe to hear about changes by email.

Current and planned sub-processors

  • Supabase

    Database, sign-in and file storage

    Data
    Account details, everything you create or upload, usage and credits
    Where
    EU (Ireland)
    Safeguards
    Data stays in the EU; Standard Contractual Clauses for support access
  • Vercel

    Hosting the app and running its server functions

    Data
    Requests, IP addresses, technical logs
    Where
    EU functions (Ireland), global edge network
    Safeguards
    EU–US Data Privacy Framework and Standard Contractual Clauses
  • Anthropic (Claude API)

    Writing, code, assistant and research with Claude

    Data
    Prompts, the pictures and documents you choose to use, conversations with the assistant, generated text and code
    Where
    United States
    Safeguards
    Standard Contractual Clauses (Anthropic's Data Processing Addendum). API data is not used to train Anthropic's models and is deleted within 30 days (up to 2 years if flagged as misuse)
  • Google (Gemini API, Veo)

    Generating and editing images and video, and reading audio and video you add

    Data
    Prompts, the files you choose to use, generated results
    Where
    United States and other Google locations
    Safeguards
    EU–US Data Privacy Framework and Standard Contractual Clauses. Paid API data is not used to train Google's models
  • ElevenLabs

    Voice, music, sound effects and transcription, live captions and call transcripts

    Data
    Text to speak, audio you record or upload; in calls, the voice of whoever is speaking while captions or notes are on
    Where
    United States and EU
    Safeguards
    Standard Contractual Clauses
  • Stripe

    Sells our plans and credit packs as our reseller (merchant of record, through Link): checkout, subscriptions, VAT, receipts and invoices, refunds, chargebacks and fraud checks

    Data
    Name, email, billing address, payment method (card details go straight to Stripe, never to us), what you bought and when
    Where
    EU (Ireland) and United States
    Safeguards
    EU–US Data Privacy Framework and Standard Contractual Clauses (Stripe's Data Processing Agreement)
  • LiveKitPlanned, not yet in use

    Carrying the audio, video and shared screens of calls through its media servers, once our call server is switched on (until then calls go straight between devices)

    Data
    Call audio and video while in transit (not recorded or stored), participant names and technical connection data
    Where
    EU and global edge network (LiveKit Cloud)
    Safeguards
    Standard Contractual Clauses
  • Cloudflare

    Helping devices find each other for calls (STUN, in use now); later, once switched on, hosting published websites, spam protection on forms, and a bot check when you sign in or create an account (Turnstile)

    Data
    IP addresses and connection details for calls; later, published site files, visitor requests, form submissions, and the browser signals the bot check reads
    Where
    EU and global edge network
    Safeguards
    EU–US Data Privacy Framework and Standard Contractual Clauses
  • SEO Mommy

    Search checks, keyword research, articles and outreach drafts for your websites, when you use SEO

    Data
    Your website's address and public pages, the business details and brief you give for it, and the articles and drafts made for it
    Where
    Lovable Cloud (its region is being confirmed)
    Safeguards
    Being confirmed with Lovable
  • Resend

    Sending sign-in, notification and receipt emails, and the campaigns businesses send to their leads

    Data
    Email address, email content, delivery events
    Where
    United States
    Safeguards
    Standard Contractual Clauses
  • SentryPlanned, not yet in use

    Error reports so we can fix problems

    Data
    Technical error details with personal data removed where possible
    Where
    EU (Germany)
    Safeguards
    Data stays in the EU

Services you connect yourself

Your own Claude key, GitHub, Vercel and your own Supabase project are connected with your own accounts. They work under your contract with them, not as our sub-processors. (Claude through InksForm's own account is a sub-processor, listed above.)

Get updates

We email you at least 30 days before a new sub-processor starts.

We use your email only for these updates; unsubscribe any time. Privacy