This page explains Paradaq's controller and processor roles, subprocessor list, international transfer safeguards, and model-training behavior for website, backend, and mobile app processing.
For the feature-by-feature processing inventory covering purposes, legal bases, retention, transfers, and user controls, see the Data Processing Inventory.
1. DPA decision for professional EU users
Paradaq offers a self-serve DPA for professional EU users when they use Paradaq to process client, customer, or work content. Custom signatures or questions can be sent to info@paradaq.com.
The DPA applies to customer-controlled uploaded work content and related app records. Consumer account administration, billing, analytics, support, feedback handling, bug-report handling, internal issue tracking, security, and legal compliance data remain covered by the Privacy Policy where Paradaq decides the purposes and means of processing.
2. Role analysis
| Role | Data and processing |
|---|---|
| Paradaq controller | Account, auth, billing entitlement, waitlist/email, analytics consent/events, security logs, support requests, feedback, bug reports, internal issue tracking, legal requests, abuse prevention, and product reliability records. |
| User or professional customer controller; Paradaq processor | Uploaded screenshots, text, documents, voice/audio, transcripts, extraction payloads/results, image object paths, and client/project/task/calendar work content submitted or stored by the user. |
| Independent platform | Apple and Google process app-store account, checkout, subscription, refund, and platform records under their own platform terms. Paradaq documents them because users encounter them in the purchase and distribution flow. |
3. Subprocessor and transfer matrix
Cloud transcription is provided through OpenAI; no separate cloud transcription provider is currently identified in the codebase.
| Provider | Purpose | Data categories | Country / region | Transfer basis | DPA / source | Model training / secondary use |
|---|---|---|---|---|---|---|
| Supabase | Authentication, database, storage, Edge Functions, and deletion audit support. | Account identifiers, profile data, client/project/task/calendar work content, extraction history, intake jobs, image object paths, consent and deletion records. | European Union project region, with provider operations and support that may involve the United States or other approved locations. | DPA, EU hosting where configured, and Standard Contractual Clauses or adequacy mechanisms where applicable. | Supabase legal | No model training role for Paradaq customer content. |
| OpenAI API | AI extraction and cloud transcription for content the user submits. | Uploaded screenshots, text, documents, voice/audio, transcripts, extracted fields, and prompt context needed to provide the feature. | United States and other OpenAI processing locations. | OpenAI DPA and Standard Contractual Clauses or adequacy mechanisms where applicable. | OpenAI DPA | API inputs and outputs are not used to train OpenAI models by default unless Paradaq explicitly opts in. |
| PostHog EU | Optional product and website analytics after consent. | Event data, screen interaction metadata, consented analytics identifiers, and masked replay data where enabled. | European Union cloud region. | EU processing region, DPA, and Standard Contractual Clauses or Data Privacy Framework safeguards where applicable. | PostHog trust center | Used for analytics and product improvement reporting, not to train Paradaq AI extraction models. |
| Sentry | Crash, error, performance, logs, traces, and masked replay diagnostics after analytics consent. | Crash reports, diagnostics, logs, traces, device/app metadata, and masked replay data. Default PII collection is disabled. | European Union and United States, based on Sentry product storage and subprocessors. | Sentry DPA, Standard Contractual Clauses, and Data Privacy Framework safeguards where applicable. | Sentry DPA | Used for observability and support diagnostics, not to train Paradaq AI extraction models. |
| RevenueCat | Subscription entitlement and purchase infrastructure. | RevenueCat customer id, Supabase user id mapping, entitlement state, product identifiers, and store transaction references. | United States and cloud infrastructure locations used by RevenueCat. | RevenueCat DPA, Standard Contractual Clauses, and adequacy mechanisms where applicable. | RevenueCat DPA | May use operational data to provide and improve billing services under its terms; not used to train Paradaq AI extraction models. |
| Brevo | Waitlist, pre-launch, transactional, and optional marketing email workflows. | Email address, optional first name, locale, source page, platform interest, consent metadata, and unsubscribe metadata. | European Union and other Brevo/service-provider locations. | Brevo DPA and Standard Contractual Clauses or adequacy mechanisms where applicable. | Brevo DPA help | Used for email delivery and campaign operations, not to train Paradaq AI extraction models. |
| Tally | Feedback forms, bug-report forms, early tester forms, and structured user-submitted feedback. | Name/email if provided, form responses, bug descriptions, feature requests, screenshots/attachments if enabled, technical context submitted by the user, timestamps, and form metadata. | Belgium / European Union; Tally states that form data is stored in Europe. | Tally DPA, EU processing, and Standard Contractual Clauses where applicable. | Tally DPA | Used to provide form collection and response management; not used to train Paradaq AI extraction models. |
| Linear | Internal issue tracking, bug triage, product planning, feature-request management, support escalation, and reliability workflows. | Issue titles/descriptions, reproduction steps, screenshots/attachments if copied into issues, app/device/browser details, user identifiers if needed for support, support summaries, comments, labels, and issue history. | United States and other Linear/service-provider locations. | Linear DPA and Standard Contractual Clauses or adequacy mechanisms where applicable. | Linear DPA | Used for issue tracking and product operations; not used to train Paradaq AI extraction models. |
| Vercel | Website, backend route, and serverless hosting for Paradaq web APIs. | HTTP requests, server logs, route execution metadata, and submitted service content while API routes process requests. | United States, European Union, and Vercel infrastructure regions selected by deployment. | Vercel DPA, Standard Contractual Clauses, and adequacy mechanisms where applicable. | Vercel DPA | Used for hosting and operational diagnostics, not to train Paradaq AI extraction models. |
| Apple | App Store distribution, in-app purchase checkout, subscription management, refunds, and platform records. | Store account, purchase, refund, device/platform, and app privacy disclosure data handled by Apple as a platform provider. | Apple global processing locations. | Apple platform terms, privacy documentation, and transfer safeguards maintained by Apple. | Apple app privacy details | Independent platform processing; not used to train Paradaq AI extraction models. |
| Google Play distribution, purchase checkout, subscription management, refunds, Android app data safety disclosures, and optional Google sign-in. | Store account, purchase, refund, device/platform, Google OAuth, and app data safety information handled by Google as a platform provider. | Google global processing locations. | Google platform terms, privacy documentation, and transfer safeguards maintained by Google. | Google Play data safety | Independent platform processing; not used to train Paradaq AI extraction models. | |
| Support email provider | Support, privacy, billing, and legal request handling for info@paradaq.com. | Email address, message content, attachments voluntarily sent by the requester, request metadata, and follow-up history. | Provider-supported international processing, with EU-region handling used where available. | Provider DPA, Standard Contractual Clauses, and adequacy mechanisms where applicable. | Contact Paradaq | Used for support handling only, not to train Paradaq AI extraction models. |
4. International transfers
Paradaq uses EU regions where available. Where a provider or platform processes personal data outside the EEA, Paradaq relies on the provider's DPA, Standard Contractual Clauses, the EU-US Data Privacy Framework or another adequacy decision where applicable, and reasonable supplementary safeguards.
Tally is preferred for feedback forms because it is EU-based and states that form data is stored in Europe. Linear may involve processing outside the EEA and should therefore be used with data minimization: avoid copying unnecessary personal data, client content, sensitive screenshots, passwords, tokens, or private message content into issues.
5. Change control
This matrix is reviewed before adding a new processor and whenever a listed provider changes its processing region, DPA, subprocessor list, or model-training behavior.