Sub-processors
Version: 2026-10-01Effective: Last updated:
Draft – under legal review
This text is still being reviewed by our lawyer. The final version may differ; we will tell you in advance about material changes and ask you to accept them again.
The providers that process personal data on our behalf to provide Sayweek (Art. 28(2) and (4) GDPR), and the services you connect yourself. This list forms part of the Data Processing Agreement.
1. For every workspace
The service does not work without these; they may process every customer’s data.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Vercel Vercel Inc. | hosting of the app and the website (server functions, CDN), scheduled jobs | all service data in transit (while processed), IP address, technical logs | EU (Frankfurt, fra1); CDN worldwide; parent company: USA |
| Neon Neon Inc. (Databricks) | database (PostgreSQL) and its backups | all service data | EU (Frankfurt, AWS eu-central-1); parent company: USA |
| Anthropic Anthropic PBC | AI writing (Claude): posts, ideas, style rules, summaries, the website chat | the content a request needs (brand and post data, ideas, masked mail and CRM excerpts, chat messages); no training on it | USA |
| Resend Resend (Plus Five Five, Inc.) | sending e-mail (notifications, reports, sign-in and password-reset links, product news) and reporting delivery events | name, e-mail address, message content; for product news: delivery, open, click, bounce, spam complaint | USA |
| Stripe Stripe Payments Europe, Ltd. / Stripe, Inc. | subscriptions, payments (card, Link), invoicing, tax id checks | billing name, address, e-mail, tax id, payment details (only Stripe sees card data) | EU (Ireland) / USA |
2. Only when the feature is switched on
We only use these if you use the feature (e.g. voice notes, image generation, video upload, PayPal payment, push notifications), or if we switched it on for operating the service (error reporting).
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Postiz Postiz | scheduling and publishing posts to the social networks (where no direct integration is used) | the approved post’s text and images, time, channel, statistics | depends on the connected Postiz instance (Postiz cloud: EU) |
| OpenAI OpenAI, L.L.C. / OpenAI Ireland Ltd. | turning voice notes into text, image generation, alternative idea suggestions (ChatGPT) | the audio recording, the image prompt, the brand data a request needs; no training on it | USA |
| Google Gemini Google LLC / Google Ireland Ltd. | turning voice notes into text (when OpenAI is not used), image generation, alternative idea suggestions | the audio recording, the image prompt, the brand data a request needs (paid API: no training on it) | USA / worldwide |
| Vercel Blob Vercel Inc. | storing uploaded videos until they are published (YouTube, TikTok, Instagram) | the video file | USA / EU |
| PayPal PayPal (Europe) S.à r.l. et Cie, S.C.A. | payment with PayPal, if you choose it | billing name, e-mail, amount, subscription id | EU (Luxembourg) / USA |
| Meta – WhatsApp Business Platform Meta Platforms Ireland Ltd. | the Sayweek WhatsApp bot: receiving the messages, links and voice notes sent to the bot, and sending the replies | phone number / chat id, display name, message content | EU / USA |
| Sentry Functional Software, Inc. | reporting unexpected server errors (only when switched on) | error message, affected page, technical details; no content is sent on purpose | USA |
| Apple Push Notification service / Firebase Cloud Messaging / Web Push Apple Inc. / Google LLC / Mozilla Corporation / Microsoft Corporation | delivering notifications to the phone apps and the browser, if you switch them on | device token, the notification’s title and short text | USA / worldwide |
[role of Stripe and PayPal: whether they act as independent controllers for part of the payment data (fraud prevention, financial regulation); name of the provider that receives inbound e-mail (the idea inbox)]
3. Services you connect (not our sub-processors)
These are your own accounts. Sayweek talks to them on your instructions (reading, or publishing after your approval), and the provider handles the data under its own terms and privacy policy. Exactly what we fetch from them is described in section 2 of the Privacy Policy.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Google (Calendar, Gmail, Drive, Meet, Analytics 4, YouTube, Business Profile, Sign-In) Google LLC / Google Ireland Ltd. | reading your connected Google account (Meet transcripts too), YouTube uploads and Business Profile posts on your behalf, sign-in | see the Privacy Policy (read-only, Limited Use) | USA / EU |
| Microsoft 365 (Entra ID, Graph: Outlook, OneDrive, SharePoint, Teams) Microsoft Corporation / Microsoft Ireland Operations Ltd. | sign-in with a Microsoft account; read-only: Outlook calendar and mail, chosen OneDrive / SharePoint files, Teams meeting transcripts; notifications to a Teams channel | name, e-mail address; calendar events, mail subjects and snippets, files, transcripts (not stored); notification text | USA / EU |
| Apple (iCloud Calendar, Reminders) Apple Inc. / Apple Distribution International Ltd. | reading your iCloud calendar (CalDAV), the “Sayweek” reminders list | calendar events, reminders | USA / EU |
| LinkedIn LinkedIn Ireland Unlimited Company | posting on your behalf, statistics and comments of your own posts | post, statistics, comments (48 hours at most) | EU / USA |
| Meta (Facebook, Instagram, Threads) Meta Platforms Ireland Ltd. | posting on your behalf, statistics, comments, public competitor numbers | post, statistics, comments (48 hours at most) | EU / USA |
| TikTok TikTok Technology Ltd. | publishing videos and photos, account name and picture, view counts | post, account details, statistics | EU / worldwide |
| Bluesky Bluesky Social, PBC | posting on your behalf with an app password created for Sayweek, statistics of your own posts | post, account id, statistics; the app password is stored encrypted | USA |
| Zoom, Fireflies.ai, Fathom, tl;dv Zoom Communications, Inc. / Fireflies.AI Corp. / Fathom Video, Inc. / tl;dv | reading the transcripts of your recent meetings for topic ideas (in memory only); you can also add a transcript by hand (paste, .txt / .vtt / .srt / .docx upload, a forwarded recap e-mail) | meeting transcript (not stored – only the ideas written from it and a hash of its words; only a masked excerpt goes to the AI) | USA / EU |
| Telegram Telegram Messenger Inc. | the Sayweek Telegram bot: messages you send to the bot become ideas in your workspace | chat id, display name, message content | worldwide |
| Unsplash, Pexels Unsplash Inc. / Pexels GmbH | stock photo search; the chosen photo is added to the post with the photographer’s credit | only the search words – no personal data | USA / EU |
| Zapier, Make, API, MCP (Claude, ChatGPT) Zapier, Inc. / Celonis s.r.o. (Make) / Anthropic PBC / OpenAI | with your API key or approved connection, they read and write your posts and ideas within the permissions you grant | the workspace’s posts and ideas, as far as the permissions allow | depends on the service you choose |
| Notion, Canva, HubSpot, Pipedrive Notion Labs, Inc. / Canva Pty Ltd / HubSpot, Inc. / Pipedrive OÜ | content calendar and ideas (Notion), designs (Canva), deal events as topic ideas (HubSpot, Pipedrive – read-only) | see the Privacy Policy | USA / EU / Australia |
| Slack Slack Technologies, LLC | notifications to the Slack channel you set (webhook) | the notification’s text and link | USA |
4. Transfers outside the EU
The database and the application run in the EU (Frankfurt). For providers in the USA or another third country, transfers rely on the European Commission’s Standard Contractual Clauses (SCCs) or, where the provider is certified, on the EU–US Data Privacy Framework. [verify per provider: DPF certification, the signed DPA/SCCs, the actual storage region]
5. When the list changes
- We notify workspace owners by e-mail at least 30 days before a new or replaced sub-processor is engaged, and update this page.
- During that time you may object on data protection grounds at hello@sayweek.com. If we cannot find a solution, you may terminate free of charge before the change – see section 9 of the Data Processing Agreement.
- In an emergency (e.g. a provider shuts down unexpectedly or must be replaced for security reasons) we may switch at shorter notice; we then inform you immediately, and your right to object applies in the same way.