Last updated: 15 September 2026 · The companies that touch your data so that Parley Notes can work. Operated by Carbon Bridge Services B.V. This list belongs with the privacy policy.
A sub-processor is a company we bring in to run part of Parley, and which handles your personal data while doing it. We have a data processing agreement with each of them. Each one may use your data only to do the job we give it, and for nothing else.
We update this page whenever the list changes. If you use Parley for your business and you need a data processing agreement, write to us and we will send you one.
| Who | What they do for us | What they receive | Where | Safeguard for transfers out of the EEA |
|---|---|---|---|---|
| Google Cloud (Cloud Run, Firestore, Firebase Authentication, Cloud Storage) | Runs our backend, stores your notes, holds your sign-in | Everything you sync, your account identity | EU, europe-west1 (Belgium) | Your notes stay in the EU. For anything that does leave it: Google Cloud's Data Processing Addendum with the EU Standard Contractual Clauses; Google is certified under the EU-US Data Privacy Framework |
| Google Gemini API | Transcribes audio, writes summaries, answers Ask Parley | The audio or the transcript being processed | Global, not pinned to a region | Google's data processing terms for the API with the EU Standard Contractual Clauses; Google is certified under the EU-US Data Privacy Framework |
| Google Play | Phone subscriptions | Your purchase token and subscription state | Google's terms for Play purchases; Google is certified under the EU-US Data Privacy Framework | |
| Stripe | Web subscriptions, card and, in Brazil, Pix | Your email address, an account identifier, and the payment details Stripe holds | EU and US | Stripe's Data Processing Agreement with the EU Standard Contractual Clauses; Stripe is certified under the EU-US Data Privacy Framework |
| Resend | Sends our email to you, and receives mail forwarded to in.parleynotes.com | Your email address, and any mail you forward | US | Resend's Data Processing Agreement with the EU Standard Contractual Clauses |
| Microsoft (Graph) | Teams transcripts and Outlook Calendar, if you connect them | The calls and events you asked Parley to fetch | EU and US | Microsoft's Data Protection Addendum with the EU Standard Contractual Clauses; Microsoft is certified under the EU-US Data Privacy Framework |
| Slack | The threads you react to, if you connect it | The text of those threads | US | Slack's Data Processing Addendum with the EU Standard Contractual Clauses; Slack is certified under the EU-US Data Privacy Framework |
| Vercel | Hosts parleynotes.com | Site visits only, never your notes | EU and US | Vercel's Data Processing Agreement with the EU Standard Contractual Clauses; Vercel is certified under the EU-US Data Privacy Framework |
Your data reaches our backend and database in Belgium. The UK has made adequacy regulations covering the European Economic Area, so that transfer needs no extra instrument. For the recipients above that sit outside the EEA, and for the Gemini step, which is not pinned to a region, the safeguard is the UK Addendum to those clauses in each supplier's terms and, where the supplier is certified under the UK Extension to the Data Privacy Framework, that certification.
Your data leaves Brazil as soon as it syncs, because our backend and database are in Belgium, and some of the recipients above are in the United States. The safeguard for those transfers is being aligned to the ANPD's standard contractual clauses (Resolução CD/ANPD nº 19/2024) contract by contract; until that is complete the transfer rests on its necessity for the contract with you (LGPD art. 33, IX).
When we add, replace or remove a sub-processor, we update this page and the date at the top of it, so the list you are reading is the current one.
Questions, or a request for a copy of the agreement or the transfer instrument covering any supplier on this list: admin@parleynotes.com.