This page explains Paradaq's controller and processor roles, subprocessor list, international transfer safeguards, and model-training behavior for website, backend, and mobile app processing.
For the feature-by-feature processing inventory covering purposes, legal bases, retention, transfers, and user controls, see the Data Processing Inventory.
1. DPA decision for professional EU users
Paradaq offers a self-serve DPA for professional EU users when they use Paradaq to process client, customer, or work content. Custom signatures or questions can be sent to info@paradaq.com.
The DPA applies to customer-controlled uploaded work content and related app records. Consumer account administration, billing, analytics, support, security, and legal compliance data remain covered by the Privacy Policy where Paradaq decides the purposes and means of processing.
2. Role analysis
| Role | Data and processing |
|---|---|
| Paradaq controller | Account, auth, billing entitlement, waitlist/email, analytics consent/events, security logs, support requests, legal requests, abuse prevention, and product reliability records. |
| User or professional customer controller; Paradaq processor | Uploaded screenshots, text, documents, voice/audio, transcripts, extraction payloads/results, image object paths, and client/project/task/calendar work content submitted or stored by the user. |
| Independent platform | Apple and Google process app-store account, checkout, subscription, refund, and platform records under their own platform terms. Paradaq documents them because users encounter them in the purchase and distribution flow. |
3. Subprocessor and transfer matrix
Cloud transcription is provided through OpenAI; no separate cloud transcription provider is currently identified in the codebase.
| Provider | Purpose | Data categories | Country / region | Transfer basis | DPA / source | Model training / secondary use |
|---|---|---|---|---|---|---|
| Supabase | Authentication, database, storage, Edge Functions, and deletion audit support. | Account identifiers, profile data, client/project/task/calendar work content, extraction history, intake jobs, image object paths, consent and deletion records. | European Union project region, with provider operations and support that may involve the United States or other approved locations. | DPA, EU hosting where configured, and Standard Contractual Clauses or adequacy mechanisms where applicable. | Supabase legal | No model training role for Paradaq customer content. |
| OpenAI API | AI extraction and cloud transcription for content the user submits. | Uploaded screenshots, text, documents, voice/audio, transcripts, extracted fields, and prompt context needed to provide the feature. | United States and other OpenAI processing locations. | OpenAI DPA and Standard Contractual Clauses or adequacy mechanisms where applicable. | OpenAI DPA | API inputs and outputs are not used to train OpenAI models by default unless Paradaq explicitly opts in. |
| PostHog EU | Optional product and website analytics after consent. | Event data, screen interaction metadata, consented analytics identifiers, and masked replay data where enabled. | European Union cloud region. | EU processing region, DPA, and Standard Contractual Clauses or Data Privacy Framework safeguards where applicable. | PostHog trust center | Used for analytics and product improvement reporting, not to train Paradaq AI extraction models. |
| Sentry | Crash, error, performance, logs, traces, and masked replay diagnostics after analytics consent. | Crash reports, diagnostics, logs, traces, device/app metadata, and masked replay data. Default PII collection is disabled. | European Union and United States, based on Sentry product storage and subprocessors. | Sentry DPA, Standard Contractual Clauses, and Data Privacy Framework safeguards where applicable. | Sentry DPA | Used for observability and support diagnostics, not to train Paradaq AI extraction models. |
| RevenueCat | Subscription entitlement and purchase infrastructure. | RevenueCat customer id, Supabase user id mapping, entitlement state, product identifiers, and store transaction references. | United States and cloud infrastructure locations used by RevenueCat. | RevenueCat DPA, Standard Contractual Clauses, and adequacy mechanisms where applicable. | RevenueCat DPA | May use operational data to provide and improve billing services under its terms; not used to train Paradaq AI extraction models. |
| Brevo | Waitlist, pre-launch, transactional, and optional marketing email workflows. | Email address, optional first name, locale, source page, platform interest, consent metadata, and unsubscribe metadata. | European Union and other Brevo/service-provider locations. | Brevo DPA and Standard Contractual Clauses or adequacy mechanisms where applicable. | Brevo DPA help | Used for email delivery and campaign operations, not to train Paradaq AI extraction models. |
| Vercel | Website, backend route, and serverless hosting for Paradaq web APIs. | HTTP requests, server logs, route execution metadata, and submitted service content while API routes process requests. | United States, European Union, and Vercel infrastructure regions selected by deployment. | Vercel DPA, Standard Contractual Clauses, and adequacy mechanisms where applicable. | Vercel DPA | Used for hosting and operational diagnostics, not to train Paradaq AI extraction models. |
| Apple | App Store distribution, in-app purchase checkout, subscription management, refunds, and platform records. | Store account, purchase, refund, device/platform, and app privacy disclosure data handled by Apple as a platform provider. | Apple global processing locations. | Apple platform terms, privacy documentation, and transfer safeguards maintained by Apple. | Apple app privacy details | Independent platform processing; not used to train Paradaq AI extraction models. |
| Google Play distribution, purchase checkout, subscription management, refunds, Android app data safety disclosures, and optional Google sign-in. | Store account, purchase, refund, device/platform, Google OAuth, and app data safety information handled by Google as a platform provider. | Google global processing locations. | Google platform terms, privacy documentation, and transfer safeguards maintained by Google. | Google Play data safety | Independent platform processing; not used to train Paradaq AI extraction models. | |
| Support email provider | Support, privacy, billing, and legal request handling for info@paradaq.com. | Email address, message content, attachments voluntarily sent by the requester, request metadata, and follow-up history. | Provider-supported international processing, with EU-region handling used where available. | Provider DPA, Standard Contractual Clauses, and adequacy mechanisms where applicable. | Contact Paradaq | Used for support handling only, not to train Paradaq AI extraction models. |
4. International transfers
Paradaq uses EU regions where available. Where a provider or platform processes personal data outside the EEA, Paradaq relies on the provider's DPA, Standard Contractual Clauses, the EU-US Data Privacy Framework or another adequacy decision where applicable, and reasonable supplementary safeguards.
5. Change control
This matrix is reviewed before adding a new processor and whenever a listed provider changes its processing region, DPA, subprocessor list, or model-training behavior.