Sub-processors
Four companies process data on our behalf. Each one is listed below with what it does and where it does it.
None of them is an advertising or analytics company, and none of them receives your music for any purpose of their own.
We give 30 days notice by email before adding one.
Why this page exists
European data protection law requires us to tell you who else handles your data. Publishing it also happens to be the honest thing to do, so it is a page rather than a paragraph you have to request.
The list
| Company | What it does | What it can see | Where |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, file storage and network protection | Your files as stored data, and request metadata | European Union |
| Supabase, Inc. | Database and authentication | Account details, catalogue metadata, password hashes. No audio. | European Union |
| Polar Software, Inc. | Payments, as merchant of record | Billing name, email, address for tax, payment method. No audio. | United States, under standard contractual clauses |
| Sendinblue SAS (Brevo) | Transactional email | Your email address and the contents of emails we send you. No audio. | European Union |
What none of them do
No company on this list may use your data for its own purposes. Each is bound by a data processing agreement that permits processing only on our instructions.
Your audio is seen by exactly one of them, and only as stored bytes it holds on our behalf. It is not sent to a payment provider, an email provider, an analytics provider or an AI provider, because none of them has any reason to receive it.
Changes
Before we add a sub-processor we email every account holder 30 days beforehand. If you object, tell us within those 30 days. If we cannot resolve it, you can cancel and receive a pro rata refund of anything you have paid in advance.
Questions: privacy@northwestfalls.com.