Sub-processors
Draft — not legal advice — pending review by a lawyer. This page describes how the product works today; the reviewed text will replace it before the service is sold.
The companies that process personal data on our behalf, what each one receives, and where. Agreements with each are being put in place before launch; the table says which are signed.
On this page
Current sub-processors
| Provider | What for | What it receives | Where | Agreement |
|---|---|---|---|---|
| Supabase | Database and sign-in (authentication) | Your account (e-mail address, hashed password), profile, preferences, organisation memberships, training record, billing status mirror, security audit entries | Hosting region to be confirmed before launch (an EU region is intended) | To be signed before launch |
| Railway | Hosting the website and the realtime training service | Web requests, your voice audio in transit while you transmit, short-lived server logs (no audio, no transcripts) | Region to be confirmed before launch | To be signed before launch |
| AssemblyAI | Speech recognition | The audio of each transmission (at most 60 seconds) and a list of expected aviation words for the exercise; no name or e-mail | EU endpoint (sync.eu.assemblyai.com) - the only endpoint the adapter uses; the provider's retention of that audio is to be confirmed in the DPA | To be signed before launch |
| Cartesia | The controller's synthetic voice | The controller's words only - which include your aircraft callsign (for example a registration you chose); never your audio or what you said | Region and retention to be confirmed in the DPA | To be signed before launch |
| Google Cloud (Vertex AI, Gemini) (when enabled) | Understanding unusual phrasing of your calls, where the deployment enables it | The recognised text of a call, your callsign, and the exercise context (expected phrases, stations); no audio, no name or e-mail | EU multi-region endpoint (aiplatform.eu.rep.googleapis.com) when configured with location "eu" | To be signed before launch |
| Stripe (when enabled) | Payments, subscriptions, invoices and VAT calculation | Your e-mail, name and billing address, VAT or tax id if given, payment details (entered on Stripe's page, never seen by us), and the plan you buy | Stripe's EU entity for EU customers; transfers under Stripe's own safeguards (to be confirmed) | To be signed before launch |
“When enabled” means the provider is used only if the deployment switches that feature on (AI interpretation of unusual phrasing; paid plans).
What none of them receives
- No provider receives a recording of your voice to keep on our behalf: audio goes only to speech recognition, one transmission at a time.
- No AI provider receives your name or e-mail address.
- No provider receives your card details from us: you enter them on Stripe's own page.
- No advertising or tracking company receives anything.
Changes
Before adding or replacing a sub-processor we will update this page. Flight schools with a data processing agreement are told in advance and may object (see the DPA template). Questions: hello@freqwise.com.