Sub-processors
Who helps us run playbakk.
These are the third parties that may process personal data on our behalf. Each receives only what it needs for its task. None of them receives your recordings — media stays on your device unless you export it yourself.
Current list
| Provider | Purpose | Data | Location | Status |
|---|---|---|---|---|
| Cloudflare, Inc. | Hosts the web app and its account database; serves requests and protects against abuse. | Account identifier, display name and email, sign-in methods and passkey public keys, encrypted authenticator configuration, hashed recovery codes and session tokens, security activity, consent request records, contact-form messages; request data such as IP address and browser details. Never your media. | Global edge network; United States | Enabled |
| Vercel Inc. | Hosts the public marketing website (playbakk.com). | Request data such as IP address and browser details, for delivery and security. The website has no accounts and sets no cookies. | Global edge network; United States | Enabled |
| Resend (Plus Five Five, Inc.) | Sends transactional email (sign-in codes, security alerts, consent requests, account notices, contact-form messages to our team and acknowledgements to senders) and, only to people who opted in, marketing email. | Recipient email address, message content (including what you write in the contact form) and delivery logs. Open and click tracking are switched off. | United States | Not yet enabled |
| Cloudflare Turnstile (Cloudflare, Inc.) | Optional anti-spam check on the contact form. | Browser and request data, such as IP address, used to tell people from automated requests. It does not receive your message. | Global edge network; United States | Not yet enabled |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Payments, subscriptions, invoices and tax calculation, once paid plans launch. | Name, email, billing address, subscription and payment records. Card details go directly to Stripe and are never stored by playbakk. | Ireland; United States | Not yet enabled |
| Supabase, Inc. | Proposed future home for the account database. | The same account data Cloudflare holds today, if and when the account store moves. | United Kingdom (London region, proposed) | Not yet enabled |
| jsDelivr (open-source CDN) | Delivers the face-detection software that runs on your device for auto-framing and call import. | Request data only (IP address, browser details). Never media — detection runs locally. | Global CDN | Enabled in the app |
| Google Cloud Storage (Google LLC) | Delivers the face-detection model file used on your device. | Request data only (IP address, browser details). Never media. | Global; United States | Enabled in the app |
“Not yet enabled” means the provider is chosen but no personal data is sent to it yet. We will update this page before that changes.
Independent services
Sign-in providers: Google, Apple, Microsoft and WeChat (Tencent). If you sign in with one of them, it acts as an independent controller for your account with it, not as our sub-processor, and its own privacy terms apply. It learns that you signed in to playbakk; we receive a stable identifier, your email address where the provider gives one, and your name (WeChat gives a nickname and no email). Passkeys involve no third party: we receive only the public key. Email sign-in codes are sent by Resend, listed above as a processor. Accounts created earlier with ChatGPT are confirmed by OpenAI one last time while they move to one of these methods; OpenAI acts as an independent controller for that.
Your calling app. playbakk does not connect to, or receive data from, WhatsApp, Telegram, FaceTime, Zoom, Teams or any other calling service. It records your own camera and microphone, and only the window you choose to share.
International transfers
Some providers process data outside the UK and EEA, including in the United States. Where they do, we rely on appropriate safeguards such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision including the UK Extension to the EU–US Data Privacy Framework where the provider is certified. [Requires counsel review: transfer mechanism for each provider and signed processor agreements]
Change history
- — Added Cloudflare Turnstile (not yet enabled). Resend now also sends sign-in codes and contact-form messages. Sign-in providers listed as independent services in place of ChatGPT sign-in.
- — First published.
Changes and notifications
We will update this list before a new sub-processor starts processing personal data. Business customers with a signed Data Processing Addendum can ask to be notified by email in advance and may object on reasonable data-protection grounds. To subscribe, email legal@playbakk.com.