{
  "addendum": "https://hazelsong.com/dpa",
  "version": "2026-10-17",
  "noticeDays": 30,
  "subprocessors": [
    {
      "name": "Vercel",
      "purpose": "Hosting the site and every page, file storage for recordings and pictures, the check that a browser rather than a program sent a sign-up or login request, and a project's own domain.",
      "receives": "Every request to the site as it is served, including the visitor's network address; recordings, photographs, pictures and voice recordings as files; the cached copy of what a wall or widget shows; a project's own domain name.",
      "scope": "customer-data",
      "basedIn": "United States",
      "whenUsed": null,
      "since": "2026-10-17",
      "announced": "2026-10-17",
      "termsRead": {
        "on": "2026-10-17",
        "url": "https://vercel.com/legal/dpa",
        "dpa": "Vercel's data processing addendum covers Pro and Enterprise teams; Hazelsong's team is on Pro. It gives 5 days to object to a new sub-processor of Vercel's, announced to those who subscribe by email. Updated March 17, 2026.",
        "transfers": "The 2021 EU standard contractual clauses and the UK IDTA, as Vercel's addendum states."
      }
    },
    {
      "name": "Upstash",
      "purpose": "The database every record other than a file is written to.",
      "receives": "Testimonials' words, names, roles, companies and ratings, permission records, histories, transcripts and translations, request lists, account records, counters and one-way fingerprints.",
      "scope": "customer-data",
      "basedIn": "United States",
      "whenUsed": null,
      "since": "2026-10-17",
      "announced": "2026-10-17",
      "termsRead": {
        "on": "2026-10-17",
        "url": "https://upstash.com/static/trust/dpa.pdf",
        "dpa": "Upstash's data processing addendum gives prior written notice of a new sub-processor and 5 days to object. Updated April 2025.",
        "transfers": "The EU-U.S. Data Privacy Framework, or else the EU standard contractual clauses, as Upstash's addendum states."
      }
    },
    {
      "name": "Anthropic",
      "purpose": "Reading testimonials for risk, automatic moderation where the business turns it on, proposing a removal, pull quotes, reports and case studies, translation, suggested labels, answers to the owner's questions, drafted form questions, and the dashboard's help assistant.",
      "receives": "A testimonial's words with the name, role and company it was written under and its rating; for the owner's questions, published words of up to 200 testimonials with no names or addresses; for the help assistant, the question and, only after Allow, the report's health lines. Never a writer's email address.",
      "scope": "customer-data",
      "basedIn": "United States",
      "whenUsed": null,
      "since": "2026-10-17",
      "announced": "2026-10-17",
      "termsRead": {
        "on": "2026-10-17",
        "url": "https://www.anthropic.com/legal/data-processing-addendum",
        "dpa": "Anthropic's data processing addendum is part of its Commercial Terms, with Anthropic as its customer's processor, breach notice within 48 hours, 15 days to object to a new sub-processor, and deletion within 30 days after the agreement ends. Effective February 24, 2025.",
        "transfers": "The EU standard contractual clauses (modules 2 and 3), with UK and Swiss addenda, as Anthropic's addendum states."
      }
    },
    {
      "name": "Deepgram",
      "purpose": "Transcribing a recording, when it is the speech service configured.",
      "receives": "The audio or video file of a recording sent for transcription.",
      "scope": "customer-data",
      "basedIn": "United States",
      "whenUsed": "Only while Hazelsong is configured with a Deepgram key; the service that produced a transcript is stored with it.",
      "since": "2026-10-17",
      "announced": "2026-10-17",
      "termsRead": {
        "on": "2026-10-17",
        "url": "https://deepgram.com/terms",
        "dpa": "No data processing addendum was found in Deepgram's Terms of Service (last updated August 6, 2026) or its master service agreement. Its terms allow it to use content sent to it to train its models unless a request opts out; every request Hazelsong sends carries that opt-out (mip_opt_out=true).",
        "transfers": "None named in the terms read."
      }
    },
    {
      "name": "OpenAI",
      "purpose": "Transcribing a recording with Whisper, when it is the speech service configured.",
      "receives": "The audio or video file of a recording sent for transcription.",
      "scope": "customer-data",
      "basedIn": "United States",
      "whenUsed": "Only while Hazelsong is configured with an OpenAI key and no service before it in the order answered.",
      "since": "2026-10-17",
      "announced": "2026-10-17",
      "termsRead": {
        "on": "2026-10-17",
        "url": "https://openai.com/policies/data-processing-addendum/",
        "dpa": "OpenAI's data processing addendum makes OpenAI its customer's processor, gives 30 days to object to a change of sub-processor and returns or deletes data on instruction. It is executed by the customer from that page. Effective January 1, 2026.",
        "transfers": "The EU standard contractual clauses, module 2 or module 3, as OpenAI's addendum states."
      }
    },
    {
      "name": "Google",
      "purpose": "Transcribing a recording with the Gemini API, when it is the speech service configured.",
      "receives": "The audio or video file of a recording sent for transcription.",
      "scope": "customer-data",
      "basedIn": "United States",
      "whenUsed": "Only while Hazelsong is configured with a Gemini key and no service before it in the order answered.",
      "since": "2026-10-17",
      "announced": "2026-10-17",
      "termsRead": {
        "on": "2026-10-17",
        "url": "https://ai.google.dev/gemini-api/terms",
        "dpa": "The Gemini API's additional terms (last updated April 28, 2026) say that for Paid Services Google processes prompts and responses under its data processing addendum and does not use them to improve its products, and that only Paid Services may be used for people in the EEA, the UK or Switzerland. The addendum itself was not read.",
        "transfers": "Not read."
      }
    },
    {
      "name": "Resend",
      "purpose": "Sending the product's email, and reporting whether a message could be delivered or was marked as spam.",
      "receives": "Each email's recipient address, the name it is addressed to and its content: requests for a testimonial and their reminder, thank-yous, private replies, notices and summaries to the owner, login links.",
      "scope": "customer-data",
      "basedIn": "United States",
      "whenUsed": null,
      "since": "2026-10-17",
      "announced": "2026-10-17",
      "termsRead": {
        "on": "2026-10-17",
        "url": "https://resend.com/legal/dpa",
        "dpa": "Resend's data processing addendum announces a new sub-processor at least 14 days in advance. Updated December 31, 2025.",
        "transfers": "The EU standard contractual clauses and the EU-U.S. Data Privacy Framework, as Resend's addendum states."
      }
    },
    {
      "name": "Paddle",
      "purpose": "Taking payment as merchant of record, its billing page, and recovering a payment that did not go through.",
      "receives": "The business's own billing details, entered on Paddle's pages; the project's public address; the customer and subscription ids Paddle issues. Nothing about a testimonial or its writer.",
      "scope": "account-only",
      "basedIn": "United Kingdom",
      "whenUsed": null,
      "since": "2026-10-17",
      "announced": "2026-10-17",
      "termsRead": {
        "on": "2026-10-17",
        "url": "https://www.paddle.com/legal/data-processing-addendum",
        "dpa": "Paddle's data processing addendum names Paddle the processor and its customer the controller, gives 14 days to object to a new sub-processor and notice of a breach without undue delay. Last updated February 1, 2023. Its role as merchant of record is not addressed there.",
        "transfers": "The EU standard contractual clauses of Decision 2021/914 and the UK Addendum, as Paddle's addendum states."
      }
    },
    {
      "name": "Stripe",
      "purpose": "Taking payment for plans and packs once Stripe is switched on, sales tax where collected, and its billing page.",
      "receives": "The plan chosen and the project's public address; the card, billing address and tax id, entered on Stripe's own pages; the customer and subscription ids Stripe issues. Nothing about a testimonial or its writer.",
      "scope": "account-only",
      "basedIn": "United States",
      "whenUsed": "Only once Stripe's variables are set; until then Paddle takes every payment.",
      "since": "2026-10-17",
      "announced": "2026-10-17",
      "termsRead": {
        "on": "2026-10-17",
        "url": "https://stripe.com/legal/dpa",
        "dpa": "Stripe's data processing agreement makes Stripe a processor for some data and a controller for other data, gives notice of a breach no later than 48 hours for GDPR data, and announces a new sub-processor 30 days ahead to those who subscribe. Last updated September 28, 2026.",
        "transfers": "Its Data Transfers Addendum: the Data Privacy Framework, the EEA standard contractual clauses or the UK addendum, as Stripe's agreement states."
      }
    }
  ]
}