Sub-processors
Last updated / effective: 1 August 2026
To run Victory Extraction, we use the third-party providers ("sub-processors") below. They process personal data only on our instructions to provide their part of the Service. See the Privacy Policy for purposes and legal bases.
| Provider | What it does for us | Data involved | Location / transfer safeguard |
|---|---|---|---|
| Stripe | Payments and checkout (independent controller — see below) | Billing identifiers, payment status (no full card data stored by us) | EU/US — EU–US Data Privacy Framework (SCC backup) |
| Anthropic | AI for diary reflections, summaries, the "Victor" assistant, and automated moderation of community content | Diary text and related context you consent to; and — for moderation — community posts, comments, poll questions and options, submitted tasks, and the display name (nickname/first name) shown with them | US — Standard Contractual Clauses (in the DPA); contractual no-training |
| OpenAI | Transcription of voice diary input (speech-to-text) | Voice audio (transcribed, not retained as audio) | US — EU–US Data Privacy Framework (SCC backup, in the DPA); contractual no-training |
| Amazon Web Services (AWS) | Storage of community media and video content | Uploaded images/videos, lesson media | US (us-east-1) — EU–US Data Privacy Framework + SCC |
| Resend | Sending transactional and marketing email | Email address, message content | US — EU–US Data Privacy Framework / SCC |
| Vercel | Hosting and cookieless web analytics | Technical/log data; aggregate analytics | US/EU — EU–US Data Privacy Framework (SCC backup) |
| Upstash | Caching and rate-limiting | Technical data, short-lived keys | EU region — no transfer outside the EEA |
| Supabase | Database hosting (PostgreSQL) | All account/app data stored in the database — including diary entries (special-category data) | US (us-east-1) — Standard Contractual Clauses (Supabase DPA) |
| "Sign in with Google" | Account identifier, basic profile (name, email) | US — EU–US Data Privacy Framework | |
| Apple | "Sign in with Apple" | Account identifier, basic profile | US — EU–US Data Privacy Framework |
| Browser push services (Google FCM, Mozilla, Apple) | Delivering the web-push notifications you opt into | Push endpoint address; notification payload (title, short text, link) — encrypted in transit | US/EU — routed by your browser vendor's push service; payload is end-to-end encrypted |
Stripe acts as an independent controller for its own payment processing, fraud prevention, and regulatory/compliance purposes; for those purposes Stripe is responsible as a controller in its own right, not as our processor.
We update this list when we add or change sub-processors. Questions: info@victoryextraction.com.