Legal

Sub-processors

Every third party that touches your data, what it does with it, and where. Announced before any change.

Version 1.0 Legal review pending

What this list is

Every third party that processes customer data on behalf of TheStakk. Under our Data Processing Agreement, customers grant a general authorisation to engage sub-processors; this list is what that authorisation refers to.

It covers processing of customer content and account data. Tools used internally by our team that never touch customer data are not sub-processors and do not appear here.

Current sub-processors

Grouped by role. Each entry names the provider, what it does with your data, and where it does it.

Role	Purpose	Data processed	Provider	Location
Hosting & database	Stores and serves the platform, workspace data and run history	All customer content, account data	to be supplied	EU
AI model inference	Processes inputs to generate outputs; contractually barred from retaining or training on them	Inputs and outputs of each run	to be supplied	to be supplied
Payment processing	Handles subscriptions, top-ups and invoices	Billing identity, payment details	to be supplied	to be supplied
Transactional email	Sends account, billing and security notifications	Email address, message content	to be supplied	to be supplied

Hosting stays in the EU

Platform hosting and processing take place inside the European Union. Where a provider processes data outside the EU, the transfer is covered by the European Commission’s Standard Contractual Clauses, and noted in the location column.

What every sub-processor signs

Each provider is bound by data protection obligations equivalent to those in our DPA: processing only on documented instructions, confidentiality, security measures, assistance with data subject requests, and deletion or return at the end of the service.

We remain fully liable to you for their performance.

Model providers

Contractually barred from retaining submitted content or training on it. Your data produces your results and nothing else.

How changes are announced

We notify customers before adding or replacing a sub-processor, by email to the account owner and by updating this page.

You may object in writing within 15 days on reasonable data protection grounds. If no workaround is found, you may terminate the affected service without penalty.

Questions or objections: info@thestakk.com.

Version history

Previous versions stay available on request.

v1.0 First publication. date to be set

Draft pending legal review. Amber items: provider names, processing locations and transfer safeguards for each role; publication date.