Sub-processors
Version 2026-10-06 · The Latvian version is legally binding. The Russian and English versions are translations for convenience.
These companies process personal data on behalf of Meistars AI. A data processing agreement is in place with each. We give at least 14 days’ notice of a new sub-processor (section 5 of the Data Processing Agreement).
Vercel Inc.
- Purpose
- App hosting and server functions, HTTPS, content delivery
- Data
- All request data in transit; server logs (IP address, browser, URL)
- Location
- Functions in the EU (Frankfurt, fra1); global network; US company
- Transfer basis
- DPF (if certified) / SCC
- Terms
- vercel.com/legal/dpa
Supabase Inc. (AWS eu-central-1)
- Purpose
- PostgreSQL database (and the provider’s backups where the plan includes them)
- Data
- All stored data
- Location
- EU (Frankfurt); support from the US
- Transfer basis
- SCC
OpenAI (OpenAI Ireland Ltd / OpenAI, L.L.C.)
- Purpose
- Speech recognition, structuring job descriptions, reading price lists
- Data
- Voice recording; job description; price-list names and units (no prices); imported price-list document or photo
- Location
- US; kept up to 30 days for abuse monitoring; not used for training
- Transfer basis
- SCC (OpenAI DPA)
GitHub Inc. (Microsoft)
- Purpose
- Source code hosting; nightly encrypted database backup (GitHub Actions artifact)
- Data
- Copy of the whole database, encrypted with AES-256 (GitHub does not hold the decryption key); kept 30 days
- Location
- US
- Transfer basis
- DPF / SCC
Resend (Plus Five Five, Inc.)
- Purpose
- E-mail delivery — once switched on: e-mail verification, password reset, notifications, approval copy to the customer, invoice, accountant link
- Data
- Recipient e-mail, subject and content (names, offer summary), invoice PDF attachment, delivery logs
- Location
- EU (Ireland, eu-west-1); US company
- Transfer basis
- DPF / SCC (access from the US)
- Terms
- resend.com/legal/dpa
The database and server functions are in the EU. Transfers to the US rely on the European Commission’s standard contractual clauses (SCC, Decision (EU) 2021/914) or, where the company is certified, the EU–US Data Privacy Framework (DPF, Commission Implementing Decision (EU) 2023/1795). DPF certification can be checked at dataprivacyframework.gov.
Deniss Harlass · denissharlass@gmail.com
Change log
- 2026-10-06 — list published: Vercel, Supabase, OpenAI, GitHub (code and encrypted nightly backups, 30 days), Resend (e-mail in the EU region; active once e-mail sending is switched on).