Subprocessors
Agendaflow (operated by Agendafix AS, Norway) uses the following subprocessors to provide the service. Customer content at rest is stored in the EU (Frankfurt, Germany). Where a subprocessor processes data in the United States, the transfer is protected by the European Commission's Standard Contractual Clauses, supplemented by the EU–US Data Privacy Framework where the vendor holds current certification.
Supabase, Inc.
Vercel, Inc.
Stripe, Inc.
Anthropic, PBC
OpenAI, LLC
OpenRouter, Inc.
Google LLC
Resend, Inc.
Loops.so
PostHog, Inc.
| Subprocessor | Purpose | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Supabase, Inc. | Application database, file storage, authentication | All customer content and account data | EU (Frankfurt, Germany)EU | Data stays in EU; SCCs (support access only) |
| Vercel, Inc. | Application hosting and content delivery | Data in transit through the application | Global edge; US entity | SCCs + EU–US Data Privacy Framework (certified) |
| Stripe, Inc. | Payment processing | Billing contact and subscription data (card data held by Stripe only) | US/EU | SCCs + EU–US Data Privacy Framework (certified) |
| Anthropic, PBC | AI text generation when a user invokes an AI feature | Agenda text content actively submitted by the user | US | SCCs (auto-incorporated in Anthropic's DPA); no training on API content |
| OpenAI, LLC | Embeddings for semantic exercise search | Search/AI-assist query text only | US | SCCs; API content not used for training |
| OpenRouter, Inc. | AI request failover routing (only if Anthropic is unavailable) | Agenda text content of the failed-over request | US | SCCs; account-level Zero-Data-Retention routing |
| Google LLC | In-app preview of uploaded Office documents | The document being previewed | US/global | SCCs + EU–US Data Privacy Framework (certified) |
| Resend, Inc. | Transactional email | Recipient name/email, email content | US | SCCs |
| Loops.so | Marketing email (opt-in only) | Name/email of opted-in users | US | SCCs |
| PostHog, Inc. | Product analytics | Usage events, email identifier; no content capture, no session recording | EU (Frankfurt — PostHog EU Cloud)EU | EU hosting; EU–US Data Privacy Framework (certified) |
Changes to this list
We give account owners at least 30 days’ email notice before adding or replacing a subprocessor that processes customer content. If you object on reasonable data-protection grounds and we cannot resolve the objection, you may terminate the affected service with a pro-rata refund of prepaid fees, as set out in our Data Processing Agreement.