Sub-processors
Who helps us run playbakk.
These are the third parties that may process personal data on our behalf. Each receives only what it needs for its task. None of them receives your recordings — media stays on your device unless you export it yourself.
Current list
| Provider | Purpose | Data | Location | Status |
|---|---|---|---|---|
| Cloudflare, Inc. | Hosts the web app and its account database; serves requests and protects against abuse. | Account identifier, display name, encrypted authenticator configuration, hashed recovery codes and session tokens, security activity, consent request records; request data such as IP address and browser details. Never your media. | Global edge network; United States | Enabled |
| Vercel Inc. | Hosts the public marketing website (playbakk.com). | Request data such as IP address and browser details, for delivery and security. The website has no accounts and sets no cookies. | Global edge network; United States | Enabled |
| Resend (Plus Five Five, Inc.) | Sends transactional email (security alerts, consent requests and account notices) and, only to people who opted in, marketing email. | Recipient email address, message content and delivery logs. Open and click tracking are switched off. | United States | Not yet enabled |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Payments, subscriptions, invoices and tax calculation, once paid plans launch. | Name, email, billing address, subscription and payment records. Card details go directly to Stripe and are never stored by playbakk. | Ireland; United States | Not yet enabled |
| Supabase, Inc. | Proposed future home for the account database. | The same account data Cloudflare holds today, if and when the account store moves. | United Kingdom (London region, proposed) | Not yet enabled |
| jsDelivr (open-source CDN) | Delivers the face-detection software that runs on your device for auto-framing and call import. | Request data only (IP address, browser details). Never media — detection runs locally. | Global CDN | Enabled in the app |
| Google Cloud Storage (Google LLC) | Delivers the face-detection model file used on your device. | Request data only (IP address, browser details). Never media. | Global; United States | Enabled in the app |
“Not yet enabled” means the provider is chosen but no personal data is sent to it yet. We will update this page before that changes.
Independent services
ChatGPT sign-in (OpenAI). You sign in to playbakk with your ChatGPT identity. OpenAI acts as an independent controller for that identity, not as our sub-processor, and its own privacy terms apply.
Your calling app. playbakk does not connect to, or receive data from, WhatsApp, Telegram, FaceTime, Zoom, Teams or any other calling service. It records your own camera and microphone, and only the window you choose to share.
International transfers
Some providers process data outside the UK and EEA, including in the United States. Where they do, we rely on appropriate safeguards such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision including the UK Extension to the EU–US Data Privacy Framework where the provider is certified. [Requires counsel review: transfer mechanism for each provider and signed processor agreements]
Changes and notifications
We will update this list before a new sub-processor starts processing personal data. Business customers with a signed Data Processing Addendum can ask to be notified by email in advance and may object on reasonable data-protection grounds. To subscribe, email legal@playbakk.com.