Flaber Subprocessors
Date of publication: 18 September 2026. Provider configuration verified on 8 September 2026.
English translation. This is a translation of the Polish original for information. The Polish version is the binding one; in the event of any discrepancy, the Polish version prevails.
To provide the Flaber Service we use entities that process data on our behalf. This page lists all of them. It is a separate document, updated independently of the Terms and the Privacy Policy — so that a change of provider does not require a change to our contract with you.
We give notice by e-mail of any intention to add or change a subprocessor at least 14 days in advance. You may object within 7 days; the rules and the consequences are set out in §6 of Annex 1 to the Terms. We have a data processing agreement with each of the entities listed, and we are liable for their acts as for our own.
| Subprocessor | Role | Place of processing | Basis for transfer outside the EEA |
|---|---|---|---|
| Supabase, Inc. | database, authentication, files | Ireland | standard contractual clauses |
| Vercel Inc. | hosting and application execution | Ireland (Dublin) | standard contractual clauses |
| Plus Five Five, Inc. (Resend) | system e-mail delivery | United States, sending from Ireland | standard contractual clauses and the EU–U.S. Data Privacy Framework |
| Functional Software, Inc. (Sentry) | application error log | Germany; account administration in the United States | EU–U.S. Data Privacy Framework and standard contractual clauses |
Stores all product data: Accounts, the Workshop, the Book and uploaded files. Processing region: Ireland. Database backups: 7 days, on rotation.
Basis for transfer: standard contractual clauses adopted by European Commission Decision 2021/914, together with the UK addendum. This entity does not participate in the EU–U.S. Data Privacy Framework — it is the only provider on this list where we rely on the clauses alone. The provider makes available a Transfer Impact Assessment.
Data processing agreement: supabase.com/legal/dpa, effective through acceptance of the service's terms. List of its own subprocessors: supabase.com/legal/customer-resources/subprocessor-list.
Runs the application and handles browser traffic. Execution is pinned to Dublin. Request logs remain with the provider; the paths in them may carry identifiers — retained for 1 day.
Basis for transfer: standard contractual clauses together with the UK addendum, contained in the provider's data processing agreement: vercel.com/legal/dpa.
Sends system messages: Team invitations, password resets, notifications.
We say this plainly, because it can be misleading: the choice of sending region controls only where a message goes out from. We chose Ireland, but the provider's account data, message metadata, logs and records are stored in the United States, regardless of the sending region. This also applies to the content of invitations, which contain the e-mail address of the person being invited, the first name of the person inviting and the name of the Team — including where that person never creates an Account.
Retention at the provider: 30 days. That is how long the provider keeps message data — content and metadata, delivery status and events, logs and metrics. This applies both to messages that go out from us and to enquiries you send to us this way. Independently of that, the provider deletes all data within 90 days of the closure of our account with it.
Basis for transfer: standard contractual clauses (Decision 2021/914, modules 2 and 3), incorporated into the provider's data processing agreement, and its certification under the EU–U.S. Data Privacy Framework.
Data processing agreement concluded on 14 January 2026. List of its own subprocessors: resend.com/legal/subprocessors.
Receives application error reports: the error message, the stack trace and the masked route. The organisation is permanently established in the European region (Germany); account administration, billing and support are handled on the provider's side in the United States.
The provider does not receive: the content of documents and form fields, session cookies or e-mail addresses. Screen recording and performance monitoring are disabled. The provider's use of error messages and stack traces to develop its own product has been switched off (verified on 8 September 2026); the use of non-identifying elements follows from its terms of service and cannot be switched off.
The IP address is visible to the provider in the connection, because the report goes directly from the browser, but its recording is disabled on the provider's side.
Basis for transfer: the provider's certification under the EU–U.S. Data Privacy Framework and standard contractual clauses as a supplementary basis.
Data processing agreement version 5.1.0, accepted on 8 September 2026. List of its own subprocessors: sentry.io/legal/subprocessors.
We do not currently use a payment provider. There is no place in the Service where payment card details can be entered (§7 of the Terms). A payment provider will appear on this list on the day it processes the first payment — not before.
The application does not load any analytics tool. Visit statistics relate solely to the sales website, which runs in a separate project and has no access to Service data.
| Date | Change |
|---|---|
| 18 September 2026 | First publication of the list. |