Sub-processors

1. Why this page exists

Procurement asks for a sub-processor list before it asks about the signal. This is that list, published rather than sent on request, so it can be read before anyone talks to us. The controller is Adolfo Gastalver Rubio, Sole trader (autónomo) — see the Privacy Policy for the legal bases and your rights, and the Data Processing Agreement for the contractual terms.

2. Sub-processors that handle personal data

Personal data here means what the Privacy Policy says it means: your email address, your plan, API-key metadata, and request telemetry. It has never included a payment card number, which only Stripe ever sees.

• Supabase — Authentication and database hosting. Processing region: EU (eu-west-1).
• Resend — Delivery of the sign-in link emails we send you. Processing region: US.
• Google Workspace — The mailbox that receives email you send us, including data-protection requests. Processing region: US.
• Stripe — Payment processing and invoicing. Processing region: US / EU.
• Vercel — Web application and API hosting and delivery. Processing region: US / EU edge.
• Cloudflare — DNS, network security, and content delivery. Processing region: Global edge.

3. Sub-processors that handle no personal data

These process the signal pipeline’s inputs and outputs. The inputs are public news text: article titles and teasers from public feeds. No customer data of any kind reaches them, and no customer request is forwarded to them.

• GitHub — Hosting of the public, append-only hash-commitment log, which contains no personal data. Processing region: US.
• Anthropic — Scoring of public news text by the signal pipeline. Receives article titles and teasers only. Processing region: US.
• Voyage AI — Embedding of public news text for clustering. Receives article titles and teasers only. Processing region: US.

Anthropic and Voyage AI were absent from the processor list on the Privacy Policy until 31 August 2026. The reason for the original omission was that they see no personal data, which is a sound reason to leave a vendor off a privacy notice and not a sound reason to leave it off a sub-processor register. They are named here with the distinction attached, because a diligence reader asking for this register expects the pipeline vendors in it.

4. International transfers

Several sub-processors are established outside the European Economic Area, principally in the United States. Where personal data is transferred outside the EEA we rely on the European Commission’s Standard Contractual Clauses or an adequacy decision, as set out in the Privacy Policy.

5. Changes to this list

A new sub-processor that will handle personal data is added to this page before it starts processing, and the change is recorded below. Customers under a Data Processing Agreement may object to a new sub-processor in writing at contact@shingou.io.

Change history

Every entry below is checkable against this project’s public commit history. A change history nobody can verify is a claim rather than a record.

• 2026-08-31 — Data Processing Agreement and the sub-processor register published. Anthropic and Voyage AI added to the register, having previously been absent from the processor list on the Privacy Policy. GitHub moved from that list into the register's no-personal-data section, where it belongs: the Privacy Policy's list is who we share personal data with, and the hash-commitment log contains none. Nothing was removed from disclosure; the register lists every vendor and the Privacy Policy links to it.
• 2026-08-14 — Terms §5 backed by the billing code: listed prices are VAT-exclusive, the rate is shown before payment, and EU businesses supplying a VAT number are billed under the reverse charge.
• 2026-08-03 — Current version. Security and data-retention statements aligned with what the system actually enforces.
• 2026-08-02 — Controller contact address moved from a personal mailbox to contact@shingou.io, so data-subject rights survive any one mailbox.
• 2026-07-04 — Terms of Service, Privacy Policy and Legal Notice first published.