Sub-processors
Last updated: November 13, 2026
Soundyaad uses the third-party services below to provide the Platform. Our primary datastore is hosted in the European Economic Area. Where a sub-processor processes personal data outside the EEA, UK, or Switzerland, the transfer is safeguarded by the mechanism listed — ordinarily EU Standard Contractual Clauses (with the UK Addendum or Swiss adaptations where applicable).
| Sub-processor | Function | Location | Transfer mechanism |
|---|---|---|---|
| Supabase (on AWS) | Primary database, authentication, and file metadata | European Economic Area (Stockholm, eu-north-1) | EEA processing; remote support access under EU SCCs |
| Vercel Inc. | Application hosting and compute | European Economic Area (Stockholm, arn1) | EEA processing; US remote access under EU SCCs |
| Sentry (Functional Software, Inc.) | Error monitoring and diagnostics (PII-scrubbed) | European Economic Area (Germany) | EEA processing; US remote access under EU SCCs |
| Cloudflare, Inc. | Object storage (R2) for audio, artwork, and user files | Global edge network | EU Standard Contractual Clauses / Cloudflare DPF participation |
| Resend (Plus Five Five, Inc.) | Transactional and fan-notification email delivery | United States | EU Standard Contractual Clauses |
| PostHog, Inc. | Product analytics (pseudonymous usage telemetry) | European Economic Area (EU cloud) | EEA processing; US remote access under EU SCCs |
| Flutterwave, Bachs, NOWPayments | Payment processing for subscription billing | Nigeria / United States | Provider processor terms / EU SCCs where applicable |
Change notifications
Enterprise and label customers receive at least 30 days' written notice before we appoint or replace a sub-processor, sent to the notice address in their agreement. Customers may object on reasonable data-protection grounds under the terms of their Data Processing Agreement.
Anyone may subscribe to sub-processor change notices by emailing privacy@soundyaad.com with the subject line "Subscribe to sub-processor updates".
Scope note
Marketing and measurement providers operating on our public pages for Soundyaad's own analytics purposes (for example, Meta Pixel or Google Tag Manager, where enabled) are covered by the Privacy Policy rather than this sub-processor list. Artist- or customer-configured tracking on their own pages is the customer's responsibility as controller of that data.