Subprocessors
Last updated 13 August 2026
These are the companies that process personal data on our behalf so Flavourpal can work. We have a data processing agreement with each of them, as required by GDPR Art. 28. Those agreements are contracts between Flavourpal and the vendor, so we link to each vendor's own terms rather than publishing our signed copies.
We do not sell your personal data, and we do not use advertising or third-party tracking cookies.
| Company | What they do | Data involved | Location | Transfer basis | Their terms |
|---|---|---|---|---|---|
| Neon (Neon, LLC — part of Databricks, Inc.) | Primary application database | Account, profile, cellar, community content, messages | United States | EU–US Data Privacy Framework — covered entity under Databricks, Inc. (verified 13 Aug 2026; status: active, re-certification under review) | PrivacyDPA terms |
| Vercel | Application hosting and serverless functions | Request data, platform logs | United States (US East) | EU–US Data Privacy Framework — Vercel Inc., active (verified 13 Aug 2026) | PrivacyDPA terms |
| Vercel Blob | Image storage | Avatars, bottle photos, community images | United States | EU–US Data Privacy Framework — Vercel Inc., active (verified 13 Aug 2026) | PrivacyDPA terms |
| Google (Gemini API) | AI analysis of shelf photos and imported collection lists | Photos and files you submit for analysis | United States | EU–US Data Privacy Framework — Google LLC, active (verified 13 Aug 2026) | PrivacyDPA terms |
| LiveKit (LiveKit Incorporated) | Voice assistant — real-time audio transport and speech processing for Flavourpal Expert. LiveKit engages its own AI inference sub-processors, all contractually bound not to retain, log or train on the audio. | Voice audio while a session is active | United States | EU–US Data Privacy Framework — LiveKit, Inc, active (verified 13 Aug 2026). SOC 2 Type II. | PrivacyDPA terms |
| Stripe | Subscription payments and creator payouts | Payment identifiers, transaction records. Stripe acts as an independent controller for payment data. | United States / Ireland | EU–US Data Privacy Framework — Stripe, LLC, active (verified 13 Aug 2026) | PrivacyDPA terms |
| Resend | Transactional email | Email address, message content we send you | United States | EU–US Data Privacy Framework — Resend, active, re-certification under review (verified 13 Aug 2026). Note: Swiss framework not listed. | PrivacyDPA terms |
Data outside the EU/EEA
Flavourpal runs on United States infrastructure — our database, our application servers and the services above. That means your personal data is transferred outside the EU/EEA.
Every company in the table above is certified under the EU–US Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection. We checked each one against the official public list at dataprivacyframework.gov on 13 August 2026, and we re-check at least once a year.
We keep this assessment under review and update this page whenever a processor, its location, or its certification changes.
The voice assistant
Flavourpal Expert runs on LiveKit, which uses its own AI model providers to turn speech into text and generate a reply. LiveKit requires each of those providers, by contract, not to retain, log, train on or fine-tune on what passes through — and publishes the full list at livekit.com/legal/sub-processors. We do not keep your audio after a session ends.
Changes
We update this page when we add or replace a processor. Questions: info@whiskykalendern.se.