Sub-processor list
In accordance with Article 28 of the General Data Protection Regulation (GDPR, EU 2016/679), this is the exhaustive list of sub-processors used to provide SpeakApp. Each processes personal data on our behalf for specific purposes under contractual safeguards in accordance with the GDPR.
This list supplements §4 of the Privacy policy and forms part of our commitment to transparency.
1. Sub-processors required to deliver the core service
| Sub-processor | Role | Data location | Legal safeguards |
|---|---|---|---|
| Supabase Inc. supabase.com |
User authentication (Magic Link OTP, Google OAuth) and database storage (preferences, subscriptions, usage) | 🇪🇺 European Union, eu-central-1 (Germany) | Signed Supabase DPA (PandaDoc, April 18, 2026) |
| Gladia SAS gladia.io |
Primary cloud speech-to-text transcription (audio to text) | 🇪🇺 France (Paris) | Signed Gladia DPA (May 2026), including EU Standard Contractual Clauses (SCCs) |
| Deepgram Inc. deepgram.com REMOVED |
— | Not applicable: no data is sent to Deepgram. This entry remains for traceability and will be deleted at the next review. | |
| Stripe Inc. stripe.com |
Payment processing, checkout, billing and subscription management | 🇪🇺 EU + 🇺🇸 United States | Stripe DPA automatically incorporated into the Stripe Services Agreement; EU SCCs included |
| Resend Plus Five Five, Inc. — resend.com |
Emails: sign-in codes, account confirmations, receipts, service notices, tips and offers | 🇪🇺 European Union, eu-west-1 (Ireland), for sending; 🇺🇸 company established in the United States | Online Resend DPA incorporated into service terms; EU SCCs and EU-U.S. Data Privacy Framework |
| Microsoft (Edge TTS, browser endpoint) | Text-to-speech playback. Used via the open-source edge-tts library, which calls the endpoint used natively by Microsoft Edge. |
Microsoft endpoint; transient processing without storage | No data processing agreement for this access method. This is the sole exception in the list, and we disclose it explicitly. Spoken text is transmitted in real time and not retained; no identifying user data accompanies the request. See Privacy §4.1 for our reasoning. Contact us if your professional use requires contractual safeguards. |
| Google Cloud (OAuth) | Google OAuth authentication as an alternative login method | 🇪🇺 EU + 🇺🇸 United States | Google Cloud Data Processing Addendum; EU SCCs |
| Functional Software Inc. (Sentry) sentry.io |
Anonymized error reports only on explicit opt-in; disabled by default | 🇺🇸 United States | Sentry DPA plus EU SCCs |
| GitHub Inc. | Hosting the application's release binaries for installer downloads | 🇺🇸 United States | GitHub DPA plus EU SCCs |
| Vercel Inc. | Hosting speakapp.work and public legal pages |
🇪🇺 European Union (edge CDN) | Vercel DPA automatically incorporated into Vercel Terms of Service |
2. Optional sub-processors for AI voice agent features
SpeakApp's AI features, including the voice agent, rewriting text before Reading, translation and transformations, are disabled by default and require explicit activation in Settings. When enabled, only one AI provider receives your content:
| Provider | Role | Location | Legal safeguards |
|---|---|---|---|
| Mistral AI mistral.ai |
SpeakApp's only AI engine: voice agent, rewriting before Reading, translation, text transformations | 🇪🇺 France; SpeakApp explicitly uses the European endpoint | DPA incorporated into Mistral's terms. Important qualification: data non-retention is an enabled account setting in the Mistral console, not an additional contractual undertaking. We do not represent it as one. |
| Google (Gemini via the browser) | Controlling the web interface at gemini.google.com |
🇺🇸 United States | Not applicable: no API calls. SpeakApp operates the webpage in your own browser and account. Google's Terms of Service govern the relationship between you and Google. |
2 bis. Providers reachable in the code but disabled by default
For accuracy we also disclose integrations which are present in the code but unused by default. No application screen can enable them: a user would have to manually edit a configuration file on their own computer and supply their own API key. No data is ever sent to these providers in a standard installation.
| Provider | Potential use | Actual status |
|---|---|---|
| OpenAI | Alternative language model | Off by default; no activation control in the interface |
| Groq Inc. | Alternative language model | Same |
| xAI (Grok) | Alternative language model | Same |
| AssemblyAI | Alternative transcription engine | Same |
| Microsoft Azure Speech | Alternative transcription engine | Same |
3. Data NOT transmitted to sub-processors
- Snippets, personal dictionary, keyboard shortcuts: stored only locally on the user's PC, encrypted with Windows DPAPI. No transfer to a sub-processor.
- AI conversation content: exchanges with Claude.ai, ChatGPT, Gemini and other AI tools are not sent to any sub-processor and not stored on any SpeakApp server. The application accesses them locally on your machine to read them aloud. The one exception requires your explicit consent: Smart Reading sends reply text to Mistral AI (§2). When disabled, no conversation content leaves your computer.
- Application logs (
debug.log): stay local on your PC and are never transmitted. Potentially sensitive values are anonymized using SHA-256 hashes. - Payment card credentials: SpeakApp never accesses them. Stripe handles checkout end-to-end through its hosted PCI-DSS Level 1 environment.
4. Notification of changes to sub-processors
Under GDPR Article 28.2, we undertake to inform users of changes to the sub-processor list. Changes are notified:
- By updating the “Last updated” date at the top of this page
- By email to active subscribers for material changes introducing a new transfer outside the EU or changing the category of data processed
- With at least 30 days' prior notice, allowing users to object and cancel their subscription at no charge if the objection is legitimate
5. Your rights
To exercise rights regarding data handled by sub-processors (access, rectification, erasure, portability, objection), email privacy@speakapp.work. We coordinate requests with the relevant providers and respond within a maximum of 30 days, in accordance with the GDPR.
For details of data categories, retention periods and legal bases, read the full Privacy policy.