Sub-processors
Last updated: 30 October 2026
Studio 404 d.o.o. ("we") uses the companies below to run HAL. Each one processes personal data only for the purpose shown and under a data processing agreement with us. Where data leaves the European Economic Area, the transfer is covered by the mechanism shown.
Your data is stored in the EU: our database, files and backups are in the Netherlands and other EU locations. Some services below process data outside the EU when you use the feature they provide.
Always in use
| Company | What it does for HAL | Data | Where | Transfer safeguard |
|---|---|---|---|---|
| Railway Corp. | Hosts our application, database, cache and uploaded files | All data in HAL | EU (Netherlands). Railway is a US company | Standard Contractual Clauses (Railway DPA) |
| Amazon Web Services EMEA SARL (SES, SNS) | Sends and receives email, delivery events | Email addresses and email content | EU (Frankfurt) | Data stays in the EU. AWS DPA with Standard Contractual Clauses for any access from outside the EU |
| Cloudflare, Inc. | Delivers the website and dashboard, DNS, stores our encrypted database backups | IP addresses and requests at the network edge; encrypted backups | Global network; backups in the EU | EU-US Data Privacy Framework and Standard Contractual Clauses |
| PostHog, Inc. | Product analytics | Usage events; in the browser only with your consent | EU (Frankfurt) | Data hosted in the EU. For any access from outside the EU: EU-US Data Privacy Framework and Standard Contractual Clauses (PostHog DPA) |
| Functional Software, Inc. (Sentry) | Error tracking | Error reports: technical details, page addresses, user and account IDs | United States | EU-US Data Privacy Framework and Standard Contractual Clauses |
| GitHub, Inc. | Runs our daily backup job | A database copy, held briefly while it is uploaded to our EU backup storage | May run outside the EU | EU-US Data Privacy Framework and Standard Contractual Clauses |
| Stripe Payments Europe, Ltd. | Payments and invoices | Billing contact, payment details, invoices | Ireland; also processed in the United States | EU-US Data Privacy Framework and Standard Contractual Clauses |
When you use the feature
| Company | Feature | Data | Where | Transfer safeguard |
|---|---|---|---|---|
| Anthropic Ireland, Limited | AI answers, suggested replies and summaries | Message content, your help-center content, contact and company details the AI needs | United States | Standard Contractual Clauses. Your data is not used to train AI models |
| Deepgram, Inc. | Live transcription of calls | Call audio | United States | Standard Contractual Clauses |
| Twilio Inc. | Phone numbers and calls | Phone numbers, call audio and call details | United States | EU-US Data Privacy Framework, Binding Corporate Rules and Standard Contractual Clauses |
| Microsoft Ireland Operations Ltd. (Azure AI Speech) | Voice for the AI phone assistant | Text of the assistant's spoken replies | EU (Ireland) | Data stays in the EU (EU Data Boundary, with limited documented exceptions) |
| Google Cloud (Text-to-Speech) | Alternative voice for the AI phone assistant | Text of the assistant's spoken replies | Global | Standard Contractual Clauses (Google Cloud DPA) |
| Google Cloud (Pub/Sub) | Notifies HAL of new mail in a Gmail inbox you connect | Mailbox and message identifiers | Global | Standard Contractual Clauses (Google Cloud DPA) |
| Apple Inc. (Push Notification service) | Notifications in the HAL iPhone app | Notification title and preview text | United States | Standard Contractual Clauses |
Services you connect
If you connect one of these to HAL, the data moves between HAL and your own account with that provider, on your instruction. The provider handles it under your agreement with them, so these aren't our sub-processors.
- Google (Gmail, Google Calendar): HAL reads and sends mail and manages calendar events in the accounts you connect.
- Slack: HAL posts notifications to the Slack workspace you choose.
- Damper (also made by Studio 404 d.o.o.): HAL sends feedback to the Damper project you choose.
Changes to this list
We'll update this page before we add or replace a sub-processor. If you have a paid plan, we'll email the account owner at least 30 days ahead. If you object for a good reason relating to data protection, tell us at [email protected]. If we can't resolve it, you can cancel the affected service and we'll refund any prepaid fees for the remaining period.