Sub-processors
Last Updated: 2026-06-19 Version: 2
This page lists the sub-processors used by Individual Entrepreneur ARTEM KHAUSTOV (“NoParrot”) to provide the Service.
We provide 30 days advance notice of any new sub-processor to active subscribers and to customers under our Data Processing Agreement (GDPR Article 28(2)).
To subscribe to sub-processor change notifications, email privacy@noparrot.com with subject
“Sub-processor Notifications”.
Current sub-processors
| Sub-processor | Purpose | Data shared | Location | DPA / SCC status |
|---|---|---|---|---|
| Paddle.com Market Ltd | Payment processing (Merchant of Record) — charges your card, collects/remits VAT/sales tax, issues invoices | Email, name, billing address, payment method, transaction amount | United Kingdom (US affiliate Paddle.com Inc. for US sales tax) | Paddle DPA; EEA→UK covered by EU adequacy decision; SCCs / UK IDTA for onward transfers |
| Fly.io, Inc. | Application hosting (backend API, FastAPI workers) | All application data | USA (with EU region options) | DPA + SCC Module 2 |
| RunPod, Inc. | Cloud GPU compute for transcription (opt-in only) | Audio file (encrypted in transit) | USA | DPA + SCC Module 2 + supplementary measures per TIA |
| Resend, Inc. | Transactional emails (account, billing, security notices) | Email address, message content | USA (with EU residency option) | DPA + SCC Module 2 |
| Cloudflare, Inc. | DDoS protection, CDN, edge geofencing | IP address (transitive), request metadata | Global edge | Standard Cloudflare DPA + SCC Module 2 |
| Plausible Insights OÜ | Cookieless web analytics | URL pageviews, referrer, country | Germany (EU) | Plausible Cloud DPA |
| db-ip.com (free dataset) | Country-level geolocation lookups | None (local database lookup; no data flows) | Local | N/A (no data transferred) |
Planned future sub-processors (Phase 2+)
These are not yet active but are likely to be added as the Service grows. We will follow the 30-day advance-notice process before activating any of these.
| Sub-processor | Purpose | Expected timing |
|---|---|---|
| Lambda Labs / Vast.ai | Additional cloud GPU capacity | When demand exceeds RunPod allocation |
| Sentry (or self-hosted GlitchTip) | Error monitoring and crash reporting (opt-in) | Phase 2 |
| ClickHouse Cloud | Telemetry warehouse | When SQLite exceeds 5k DAU or write latency threshold |
| OpenAI, Inc. (BYO-key) | Optional OpenAI MD polishing (Pro users provide their own API key) | When OpenAI polish is enabled per user |
Note: OpenAI is not a NoParrot sub-processor when Customer provides their own API key (BYOK). In that case, OpenAI is a direct contractual party of the user, not of NoParrot.
Removed sub-processors
(No removals yet. Past changes will be logged here for transparency.)
Sub-processor due diligence
For each sub-processor we:
- Review their security posture (SOC-2 reports, ISO-27001 certifications where applicable).
- Sign a Data Processing Agreement (DPA) with appropriate Standard Contractual Clauses for cross-border transfers.
- Perform a Transfer Impact Assessment (TIA) for US-located sub-processors.
- Monitor for material changes (e.g., acquisitions, regulatory actions).
- Re-evaluate annually.
Audit reports
We maintain audit reports and TIAs internally. They are available to Enterprise customers
under NDA on request to support@noparrot.com.
Sub-processor change notifications
To receive email notifications when we add or change sub-processors:
- Email
privacy@noparrot.comwith subject “Sub-processor Notifications” - Or subscribe at https://noparrot.com/legal/subprocessors/notify (planned)
Last update
This page is reviewed at least quarterly. The “Last Updated” date at the top reflects the most recent material change. A changelog of past changes is available on request.
Contact
- Privacy / sub-processor questions:
privacy@noparrot.com - General contact:
support@noparrot.com
Individual Entrepreneur ARTEM KHAUSTOV, Georgia, Tbilisi, Chugureti district, Mikheil Tsinamsavrishvili street, N 52, Georgia.