Sub-processor Register
Who processes data on our behalf, where, and under what safeguards. This register forms part of our Privacy Policy.
1. Why this page exists
UAE PDPL Art. 22 and GDPR Art. 46 require us to tell you which third parties process your personal data, where that processing happens, and what safeguards protect an international transfer. This register is where we do that in full. It is referenced from Sections 3.3, 5, 6 and 13 of our Privacy Policy and has the same standing as the policy itself.
2. Current sub-processors
| Sub-processor | Purpose | Processing location | Transfer safeguard |
|---|---|---|---|
| Anthropic PBC AI infrastructure provider | TERRA inference. Message content is sent for processing and the response returned; it is not retained by us, and is not used to train models by default under the provider's commercial terms. | United States | Standard Contractual Clauses (GDPR Art. 46); controller-to-processor safeguards under PDPL Art. 22 |
| Supabase | Authentication, profile database, TERRA usage counts | EU — Frankfurt | Processing within the EEA; DPA in place |
| Vercel | Web hosting, edge CDN, short-lived server logs | EU (Frankfurt) for compute; global CDN edges for static assets | DPA in place; SCCs for any transfer outside the EEA |
| Upstash | Rate limiting — request counts only, no identifying data | EU | Processing within the EEA; DPA in place |
| OAuth sign-in | Global | SCCs; DPA in place |
3. Changes to this register
If we add or replace a sub-processor we will update this page and the “Last updated” date above. For signed-in users, material changes are notified by email at least 30 days before they take effect, on the same terms as Section 14 of the Privacy Policy.
4. Questions
Email privacy@2050planet.com. If you believe your data has been handled improperly you may complain to the UAE Data Office or, in the EU, your national supervisory authority.