Vook uses trusted service providers, called sub-processors, to deliver the Service. This page lists every sub-processor that may process personal data on our behalf, in accordance with Article 28 of the General Data Protection Regulation (GDPR).

We update this page at least thirty (30) days before adding or replacing a sub-processor. Business customers can object during that period on reasonable data-protection grounds and, if no alternative is agreed, may terminate their subscription without penalty. This mechanism is set out in Article 4 of our Data Processing Agreement (DPA).

Last updated: 2026-09-08.

Core sub-processors

These providers process customer or end-user personal data as part of the Service.

Scaleway

• Role: application hosting; object storage for user content (audio, transcripts, derived artefacts), stored encrypted (AES-256); Key Manager wrapping opted-in recovery keys.
• Personal data: audio content (encrypted ciphertext), transcripts (encrypted ciphertext), LLM chats (encrypted ciphertext); recovery-key material.
• Entity: Scaleway S.A.S. (France, EU).
• Processing location: fr-par (Paris, France).
• Transfer basis: intra-EU; no third-country transfer. Standard Contractual Clauses (SCC) also incorporated in the DPA as a fallback.

RunPod

• Role: GPU inference for transcription and speaker diarization; ephemeral processing.
• Personal data: audio and transcript content, held as plaintext in GPU memory during inference only; ciphertext at rest.
• Entity: RunPod, Inc. (US).
• Processing location: EU/EEA workers (endpoint restricted to EU/EEA data centers, Secure Cloud).
• Transfer basis: SCC incorporated via the vendor's published DPA.

Stripe

• Role: payment processing. Acts as processor for the core service and as independent controller for fraud prevention and regulatory compliance.
• Personal data: name, email, billing details, payment metadata (not encrypted Vook-side).
• Entity: Stripe Payments Europe Ltd (Ireland, EU); Stripe LLC (US).
• Processing location: EU + US (Stripe LLC) under SCC.
• Transfer basis: SCC (Modules 1 and 2) via the Data Transfers Addendum; Stripe LLC is certified under the EU-U.S. Data Privacy Framework (DPF).

Twilio SendGrid

• Role: transactional and campaign email delivery. Processor for email content; controller for account and usage metadata.
• Personal data: email address, email content (not encrypted Vook-side).
• Entity: Twilio Inc. (US).
• Processing location: United States.
• Transfer basis: SCC incorporated in the Twilio DPA (covers SendGrid), plus Binding Corporate Rules (BCR).

Google (OAuth sign-in)

• Role: "Sign in with Google" identity provider.
• Personal data: account identifiers, email, OAuth token.
• Entity: Google Ireland Ltd (Ireland, EU); US parent (Google LLC).
• Processing location: EU / global.
• Transfer basis: SCC incorporated in the Google Cloud DPA.

Microsoft (OAuth sign-in)

• Role: "Sign in with Microsoft" identity provider.
• Personal data: account identifiers, email, OAuth token.
• Entity: Microsoft Ireland Operations Ltd (Ireland, EU); US parent (Microsoft Corporation).
• Processing location: EU / global.
• Transfer basis: SCC (2021) plus the Microsoft Additional Safeguards Addendum.

Google Gemini

• Role: large language model (LLM) for transcript summaries and chat. Receives plaintext transcript content only on the user's explicit action, gated by a first-use consent notice.
• Personal data: transcript content (plaintext, in-prompt), user prompts.
• Entity: Google LLC (US).
• Processing location: global by default (Gemini Developer API). Business customers may activate the paid EU-residency option, which pins summaries and chat to an EU endpoint (Vertex AI, EU multi-region).
• Transfer basis: SCC via the Gemini API Additional Terms (paid tier) and Google processor terms. Paid-tier terms confirm no training on user content and no retention beyond the request.

PayPal

• Role: payment processing, alongside Stripe. Acts as independent controller.
• Personal data: name, email, billing and payment metadata (not encrypted Vook-side).
• Entity: PayPal (Europe) S.à r.l. et Cie SCA (Luxembourg, EU); US parent.
• Processing location: EU + global within the PayPal group.
• Transfer basis: Binding Corporate Rules (BCR) for EEA transfers (SCC only on the UK route in the card-processing DPA).

Operational sub-processors

These providers process incidental personal data as part of running the Service (support, hosting, observability, alerting, marketing attribution).

Google Workspace (Gmail)

• Role: professional email, including customer support (contact@vook.ai).
• Personal data: email correspondence, names, any data users send to support.
• Entity: Google Ireland Ltd (Ireland, EU); US parent.
• Processing location: EU / global.
• Transfer basis: SCC via the Google Cloud / Workspace DPA.

Datadog

• Role: application logging and observability.
• Personal data: technical logs, request metadata, occasional hashed IP fingerprint (see Privacy Policy section 7).
• Entity: Datadog, Inc. (US).
• Processing location: EU1 site (datadoghq.eu, Germany); data at rest in the EU. Follow-the-sun support may access EU-stored data from outside the EU.
• Transfer basis: SCC plus the UK International Data Transfer Addendum.

Vercel

• Role: frontend and admin hosting (Next.js). Audio and transcript content never reach Vercel; content is handled client-side.
• Personal data: account and profile data, session, IP address, request metadata.
• Entity: Vercel Inc. (US).
• Processing location: EU + North America (functions run in both regions); global content delivery network (CDN) edge.
• Transfer basis: SCC (Module 2); Vercel Inc. is certified under the DPF.

Slack

• Role: internal error and information alerting (webhooks).
• Personal data: technical logs and metadata that may incidentally include personal data.
• Entity: Slack Technologies LLC (Salesforce, US).
• Processing location: United States.
• Transfer basis: SCC / Model Clauses; Slack is certified under the DPF.

Google Ads

• Role: marketing and conversion attribution. Enhanced conversions enabled (uploaded hashed email identifiers only).
• Personal data: hashed email identifiers (enhanced conversions), conversion data.
• Entity: Google Ireland Ltd (Ireland, EU); US parent.
• Processing location: EU / global (no advertiser-selectable EU region).
• Transfer basis: SCC (Appendix 3). Google Ads acts as processor for the uploaded hashed identifiers; the rest of the relationship is governed by controller-to-controller terms.