Legal

Sub-processors

Version 1.2, effective 10 October 2026 · History

In short

  • These are the only companies that process personal data for InksForm.
  • Planned ones are listed here at least 30 days before they start. Subscribe to hear about changes by email.

Current and planned sub-processors

  • Supabase

    Database, sign-in and file storage

    Data
    Account details, everything you create or upload, usage and credits
    Where
    EU (Ireland)
    Safeguards
    Data stays in the EU; Standard Contractual Clauses for support access
  • Vercel

    Hosting the app and running its server functions

    Data
    Requests, IP addresses, technical logs
    Where
    EU functions (Ireland), global edge network
    Safeguards
    EU–US Data Privacy Framework and Standard Contractual Clauses
  • Anthropic (Claude API)

    Writing, code, assistant and research with Claude

    Data
    Prompts, the pictures and documents you choose to use, conversations with the assistant, generated text and code
    Where
    United States
    Safeguards
    Standard Contractual Clauses (Anthropic's Data Processing Addendum). API data is not used to train Anthropic's models and is deleted within 30 days (up to 2 years if flagged as misuse)
  • Google (Gemini API, Veo)

    Generating and editing images and video, and reading audio and video you add

    Data
    Prompts, the files you choose to use, generated results
    Where
    United States and other Google locations
    Safeguards
    EU–US Data Privacy Framework and Standard Contractual Clauses. Paid API data is not used to train Google's models
  • ElevenLabs

    Voice, music, sound effects and transcription, live captions and call transcripts

    Data
    Text to speak, audio you record or upload; in calls, the voice of whoever is speaking while captions or notes are on
    Where
    United States and EU
    Safeguards
    Standard Contractual Clauses
  • Stripe

    Payments for plans and credit packs: checkout, subscriptions, receipts, refunds and fraud checks

    Data
    Name, email, billing address, payment method (card details go straight to Stripe, never to us), what you bought and when
    Where
    EU (Ireland) and United States
    Safeguards
    EU–US Data Privacy Framework and Standard Contractual Clauses (Stripe's Data Processing Agreement)
  • LiveKitPlanned, not yet in use

    Carrying the audio, video and shared screens of calls through its media servers, once our call server is switched on (until then calls go straight between devices)

    Data
    Call audio and video while in transit (not recorded or stored), participant names and technical connection data
    Where
    EU and global edge network (LiveKit Cloud)
    Safeguards
    Standard Contractual Clauses
  • CloudflarePlanned, not yet in use

    Hosting published websites, spam protection on forms

    Data
    Published site files, visitor requests, form submissions
    Where
    EU and global edge network
    Safeguards
    EU–US Data Privacy Framework and Standard Contractual Clauses
  • ResendPlanned, not yet in use

    Sending sign-in, notification and receipt emails

    Data
    Email address, email content
    Where
    United States
    Safeguards
    Standard Contractual Clauses
  • SentryPlanned, not yet in use

    Error reports so we can fix problems

    Data
    Technical error details with personal data removed where possible
    Where
    EU (Germany)
    Safeguards
    Data stays in the EU

Services you connect yourself

Your own Claude key, GitHub, Vercel and your own Supabase project are connected with your own accounts. They work under your contract with them, not as our sub-processors. (Claude through InksForm's own account is a sub-processor, listed above.)

Get updates

We email you at least 30 days before a new sub-processor starts.

We use your email only for these updates; unsubscribe any time. Privacy