Subprocessors
Last Updated: November 2025
Beresol BV ("we," "us," "our") uses third-party service providers ("subprocessors") to help us deliver Brubru. These subprocessors may process personal data on our behalf in accordance with our Privacy Policy.
This page lists all subprocessors we currently use, their purpose, and data location. We maintain Data Processing Agreements (DPAs) with all subprocessors to ensure GDPR compliance.
1. Infrastructure & Hosting
Supabase, Inc.
- Purpose: Database hosting, authentication, file storage
- Data Processed: User account data, chat history, amendments, uploaded documents, authentication tokens
- Data Location: European Union (primary), United States (backup)
- Website: supabase.com
- DPA: Standard Contractual Clauses (SCCs) in place
- Privacy Policy: supabase.com/privacy
Railway Corp.
- Purpose: Backend application hosting (FastAPI, PostgreSQL connections, scraper services)
- Data Processed: Application logs, temporary processing data, cached content
- Data Location: European Union (Frankfurt region) and United States
- Website: railway.app
- DPA: Standard Contractual Clauses (SCCs) in place
- Privacy Policy: railway.app/legal/privacy
SiteGround Spain S.L.
- Purpose: Frontend static hosting, SSL, CDN for brubru.beresol.eu
- Data Processed: IP addresses, browser data, page requests (minimal personal data)
- Data Location: European Union (Madrid, Spain)
- Website: siteground.com
- DPA: GDPR-compliant DPA signed
- Privacy Policy: siteground.com/privacy
2. AI & Machine Learning Services
Anthropic PBC
- Purpose: AI chat responses using Claude models (Sonnet 4, Opus 4)
- Data Processed: Chat messages, user prompts, context from uploaded documents
- Data Location: United States
- Data Retention: Prompts and outputs are not used to train Anthropic's models (per our enterprise agreement)
- Website: anthropic.com
- DPA: Enterprise DPA with SCCs
- Privacy Policy: anthropic.com/legal/privacy
OpenAI, L.L.C.
- Purpose: Backup AI service (GPT-4, GPT-3.5-turbo) when Claude is unavailable
- Data Processed: Chat messages, user prompts
- Data Location: United States
- Data Retention: 30 days (OpenAI's policy for API users)
- Website: openai.com
- DPA: OpenAI's Business Terms with SCCs
- Privacy Policy: openai.com/policies/privacy-policy
Hugging Face, Inc.
- Purpose: Specialized legal AI models (Saul-7B), multilingual embeddings (BAAI/bge-m3)
- Data Processed: Text for embedding generation, legal document analysis
- Data Location: United States, European Union (varies by model)
- Website: huggingface.co
- DPA: Inference API DPA
- Privacy Policy: huggingface.co/privacy
3. Payment Processing
Stripe, Inc.
- Purpose: Subscription billing, payment processing, invoicing
- Data Processed: Email, billing address, payment method (credit card), transaction history
- Data Location: United States, European Union
- Note: We do not store credit card numbers; Stripe handles all payment data securely
- Website: stripe.com
- DPA: Stripe Data Processing Agreement
- Privacy Policy: stripe.com/privacy
4. Authentication Services
Google LLC (OAuth)
- Purpose: Social login via Google OAuth
- Data Processed: Email, name, profile picture (if you choose to sign in with Google)
- Data Location: United States
- Website: google.com
- Privacy Policy: policies.google.com/privacy
LinkedIn Corporation (OAuth)
- Purpose: Professional social login via LinkedIn OAuth
- Data Processed: Email, name, profile information (if you choose to sign in with LinkedIn)
- Data Location: United States
- Website: linkedin.com
- Privacy Policy: linkedin.com/legal/privacy-policy
5. Optional Services (If Enabled)
Google Cloud Platform (Translation API)
- Purpose: Optional translation of chat messages and content to EU languages
- Data Processed: Text to be translated
- Data Location: European Union (when using EU endpoints), United States
- Status: Optional, not currently active
- Website: cloud.google.com
- Privacy Policy: cloud.google.com/privacy
6. Monitoring & Error Tracking (Future)
The following services may be implemented in the future. We will update this page and notify users before activating them.
Sentry (Not Currently Active)
- Purpose: Error tracking and performance monitoring
- Data Processed: Error logs, stack traces, browser metadata
- Data Location: United States
- Status: Not currently active
7. Data Transfer Safeguards
When personal data is transferred to subprocessors outside the European Economic Area (EEA), we ensure adequate protection through:
- Standard Contractual Clauses (SCCs): EU-approved model contracts for data transfers to third countries
- Data Processing Agreements (DPAs): Binding agreements with all subprocessors that specify data protection requirements
- Privacy Shield (Legacy): Some processors were certified under Privacy Shield before it was invalidated; they now use SCCs
- Adequacy Decisions: Transfers to countries deemed adequate by the European Commission
8. Changes to This List
We may add, remove, or replace subprocessors as our business needs change. Material changes to this list will be communicated via:
- Email notification (for changes affecting data security or location)
- Update to this page (check "Last Updated" date)
If you object to a new subprocessor, you may terminate your subscription in accordance with our Terms of Service.
9. Your Rights
Your rights under GDPR apply to data processed by our subprocessors. For information about your rights (access, rectification, erasure, etc.), see our Privacy Policy.
10. Contact Us
If you have questions about our subprocessors or data processing practices:
Email: hello@beresol.eu
Subject: "Subprocessor Inquiry"