Subprocessors
Last updated 13 August 2026
These are the companies that process personal data on our behalf so Flavourpal can work. We have a data processing agreement with each of them, as required by GDPR Art. 28. Those agreements are contracts between Flavourpal and the vendor, so we link to each vendor's own terms rather than publishing our signed copies.
We do not sell your personal data, and we do not use advertising or third-party tracking cookies.
| Company | What they do | Data involved | Location | Transfer basis | Their terms |
|---|---|---|---|---|---|
| Neon (Neon, LLC — part of Databricks, Inc.) | Primary application database | Account, profile, cellar, community content, messages | United States | EU–US Data Privacy Framework — covered entity under Databricks, Inc. (verified 13 Aug 2026; status: active, re-certification under review) | PrivacyDPA terms |
| Vercel | Application hosting and serverless functions | Request data, platform logs | United States (US East) | EU–US Data Privacy Framework — Vercel Inc., active (verified 13 Aug 2026) | PrivacyDPA terms |
| Vercel Blob | Image storage | Avatars, bottle photos, community images | United States | EU–US Data Privacy Framework — Vercel Inc., active (verified 13 Aug 2026) | PrivacyDPA terms |
| Google (Gemini API) | AI analysis of shelf photos and imported collection lists, and the Flavourpal Expert voice assistant (Gemini Live) — both the personal assistant and, when a club brings it into a live tasting, the audio of that room | Photos and files you submit for analysis; voice audio while a voice session is active | United States | EU–US Data Privacy Framework — Google LLC, active (verified 13 Aug 2026) | PrivacyDPA terms |
| LiveKit (LiveKit Incorporated) | Real-time audio and video transport for live tasting rooms | Voice and video while you are in a live room | United States | EU–US Data Privacy Framework — LiveKit, Inc, active (verified 13 Aug 2026). SOC 2 Type II. | PrivacyDPA terms |
| Stripe | Subscription payments and creator payouts | Payment identifiers, transaction records. Stripe acts as an independent controller for payment data. | United States / Ireland | EU–US Data Privacy Framework — Stripe, LLC, active (verified 13 Aug 2026) | PrivacyDPA terms |
| Resend | Transactional email | Email address, message content we send you | United States | EU–US Data Privacy Framework — Resend, active, re-certification under review (verified 13 Aug 2026). Note: Swiss framework not listed. | PrivacyDPA terms |
| 46elks (46elks AB) | Transactional SMS (sign-up confirmations) | Mobile number, message content we send you | Sweden (EU/EEA) | No third-country transfer — data stays within the EU/EEA. | PrivacyDPA terms |
Data outside the EU/EEA
Flavourpal runs on United States infrastructure — our database, our application servers and the services above. That means your personal data is transferred outside the EU/EEA.
Every company in the table above is certified under the EU–US Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection. We checked each one against the official public list at dataprivacyframework.gov on 13 August 2026, and we re-check at least once a year.
We keep this assessment under review and update this page whenever a processor, its location, or its certification changes.
The voice assistant
Flavourpal Expert runs on Google's Gemini Live API. While a session is active your microphone audio is streamed to Google, which returns the spoken reply. We do not keep your audio after a session ends.
A club can also bring the Expert into a live tasting room, as a silent listener, as a co-host that answers when called, or as the host that runs the tasting. While it is in the room, the audio of everyone in that room is streamed to Google in the same way. Everyone entering such a room is told before their microphone is opened, and a banner stays visible for as long as the agent is present. The club owner decides whether the agent is there at all and can remove it at any time. What the agent transcribes is stored so the club can read the tasting afterwards.
Changes
We update this page when we add or replace a processor. Questions: info@whiskykalendern.se.