Legal
Sub-processor List
Provider: Vektor HQ (enkeltmandsvirksomhed), Denmark, CVR 46519779. Last updated: June 23, 2026. Version: 3.0.
We use the sub-processors below to deliver the Service. Each processes personal data only on our instructions and under a data processing agreement. To get notified when this list changes, subscribe at contact@vektorhq.ai. We give 30 days' notice before adding or replacing a sub-processor, and you may object on reasonable data-protection grounds.
| Sub-processor | Purpose | Data processed | Location | Safeguard |
|---|---|---|---|---|
| Anthropic (Claude API) | AI generation of briefs/coaching + transcript summary | Inputs you submit for generation (may include names, company info, notes, transcript contents) | US (storage US-only; default global inference) | DPA + EU SCCs, auto-incorporated in Anthropic's Commercial Terms; inputs deleted within 30 days, not used for training |
| Render | Application hosting / compute | Application data in transit, account data | EU (Frankfurt) | DPA / SCCs |
| Supabase | Database, auth, storage, and built-in auth email (signup confirmation / magic-link emails to users) | Account data, Customer Data, brief outputs, user email | EU (Frankfurt) | DPA / SCCs |
| Stripe (Merchant of Record) | Payment processing; seller of record for self-serve | Billing/contact data, payment metadata | EU/global per Stripe | Stripe DPA |
| Web3Forms | Form-to-email relay for the contact form and new-signup notifications sent to Vektor | Name, email, message content submitted via contact form or at signup | US (AWS US-East) | Provider's privacy policy and security terms |
| PostHog (EU Cloud) | Product analytics, consent-gated (loads only after opt-in) | Usage events, device/user identifier, IP-derived data | EU (eu.posthog.com) | DPA; consent-gated per Cookie Policy |
Notes
- This list must match what's actually wired into production: Render EU + Supabase EU + Anthropic, payments via Stripe, analytics via PostHog EU Cloud (consent-gated).
- Anthropic is our main non-EEA transfer. Data is processed in the US, deleted within 30 days and never used for model training; the EU→US transfer is covered by Anthropic's DPA and EU Standard Contractual Clauses.
- Web3Forms relays our contact form and new-signup notifications to us, processing only the name, email and any message you submit, on US-based servers. Transactional emails to users (signup confirmation and magic-link sign-in) are sent by Supabase's built-in email, not Web3Forms.
- Lunar (bank) and Dinero (bookkeeping) are NOT customer sub-processors. They handle Vektor's own financial records, not Customer Data. One flag: for enterprise manual invoices, your billing contact details sit in Dinero for Danish bookkeeping compliance (5-yr), Vektor as controller under a legal obligation, not as your processor.
- If we ever use a backup payment provider (e.g. Creem) as Merchant of Record, we'll add it here with 30 days' notice first.