These are the third parties that may process personal data when you use audesti. Each is bound by contract to process it only on our instructions, keep it confidential and protect it, and each has been assessed before being engaged.
We will update this page before a new sub-processor begins handling personal data. Customers who want notice by email can ask at [email protected]; the objection procedure is in clause 7 of the DPA.
Core platform
| Provider | Role | Personal data it processes | Location |
|---|---|---|---|
| Supabase | Database, file storage, authentication | Everything stored by the platform: account data, guest details, recordings, transcripts, analysis, consent records, sign-in identities | Sydney, Australia |
| Railway | Application and background-worker hosting | All data in transit through the application | Singapore |
| Cloudflare | Network, TLS, caching, rate limiting, bot filtering | Request metadata including IP addresses; cached copies of public widget and share pages | Global edge |
AI processing
| Provider | Role | Personal data it processes | Location |
|---|---|---|---|
| OpenAI | Whisper transcription; transcript clean-up, translation and analysis (GPT-4o-mini) | The audio recording, and the transcript derived from it | United States |
| Auphonic | Audio clean-up for playback — noise reduction and volume levelling | The audio recording. Deleted from Auphonic once the cleaned copy is retrieved | Austria (EU) |
Neither provider is permitted to use this data to train models. OpenAI API data is not used for training under its API terms. Where Auphonic is unavailable or its monthly allowance is exhausted, clean-up runs locally on our own infrastructure instead and no third party sees the recording. Transcription always uses the original recording, never the cleaned copy.
Communications and payments
| Provider | Role | Personal data it processes | Location |
|---|---|---|---|
| Twilio SendGrid | Transactional email: testimonial requests, team invitations, share-permission requests, approval notices | Recipient name and email address, and the message content | United States |
| Dodo Payments | Payments and merchant of record | Billing name, email, payment details, transaction records. Acts as an independent controller, not our processor | See Dodo Payments' own terms |
| Supabase Auth | Sign-in emails (magic links) | Account email address | As above |
Card numbers, CVVs and bank details never reach audesti. They go directly to Dodo Payments.
Analytics
| Provider | Role | Personal data it processes | Location |
|---|---|---|---|
| Google Analytics 4 | Product analytics on the signed-in app and the marketing pages only | Usage events, approximate location, device and browser data, GA identifiers | United States |
| Google Sign-In | Optional sign-in method, offered through Supabase Auth | Email address and basic profile, where an account holder chooses Google | United States |
No analytics of any kind runs on the pages guests and visitors see — not the recording page, not embed widgets, not public share or showcase pages. We use no advertising or retargeting providers anywhere.
Content delivery
jsDelivr serves the icon set and stylesheet used by the interface. Loading a file from it exposes the visitor's IP address to the CDN, as with any website, and sets no cookie. Fonts are self-hosted by us, not fetched from a third party.
Not sub-processors
AI assistants an account holder connects over MCP are not our sub-processors. When an account holder authorises Claude or another MCP client, they are instructing us to disclose their data to a recipient of their choosing. What happens to it there is governed by that assistant provider's own terms and privacy policy. The account holder controls the scope, and can revoke the connection at any time from the Connector page. See clause 6.3 of the Privacy Policy.
Transfers
Where a sub-processor is outside the EEA or the UK, transfers are made under the European Commission's Standard Contractual Clauses, and the UK Addendum or UK IDTA as applicable. See clause 15.7 of the Privacy Policy.
Questions: [email protected]