Sub-processors
Effective 8 November 2026.
The companies that process personal data for Repen, what they do, what they get and how data that leaves the EU is protected. Business customers’ workspaces are covered by our Data processing agreement; we tell them at least 14 days before we add or replace one. To be told by email, write to hello@repen.app.
The list
| Who | What they do for Repen | What they get | Outside the EU |
|---|---|---|---|
| Cloudflare, Inc.United States; its global network | Hosts Repen: its servers, database, design and file storage, email sending, voice calls (huddles), page capture, image conversion, the AI gateway and the fallback speech-to-text model. | Everything Repen stores and handles. | Cloudflare’s data processing agreement, with the EU’s standard contractual clauses; EU–US Data Privacy Framework. |
| Google LLCUnited States | Generates images (Google’s image model), reached through Cloudflare’s AI gateway.Cloudflare’s sub-processor for its AI gateway, under Cloudflare’s data processing agreement with us. | The prompt and the image size, when someone asks for a generated image. | Cloudflare’s data processing agreement, with the EU’s standard contractual clauses; EU–US Data Privacy Framework. |
| X.AI Corp.United States | Turns dictation into text (xAI’s speech-to-text model), reached through Cloudflare’s AI gateway.Cloudflare’s sub-processor for its AI gateway, under Cloudflare’s data processing agreement with us. | The recording of what someone dictates. | Cloudflare’s data processing agreement, with the EU’s standard contractual clauses. |
| StripeIreland and the United States | Takes payments for paid plans and keeps their records. | The buyer’s name, email address, billing address, VAT number if any, payment details, the plan and the amounts. | Stripe’s data processing agreement, with the EU’s standard contractual clauses; EU–US Data Privacy Framework. |
| Google (Google Workspace)Ireland and the United States | Hosts the mailbox that receives what people write to hello@repen.app. | What you write to us, and your email address. | Google’s data processing terms, with the EU’s standard contractual clauses; EU–US Data Privacy Framework. |
- Cloudflare, Inc. · United States; its global network
- Hosts Repen: its servers, database, design and file storage, email sending, voice calls (huddles), page capture, image conversion, the AI gateway and the fallback speech-to-text model.
- Gets: Everything Repen stores and handles.
- Outside the EU: Cloudflare’s data processing agreement, with the EU’s standard contractual clauses; EU–US Data Privacy Framework.
- Google LLC · United States
- Generates images (Google’s image model), reached through Cloudflare’s AI gateway. Cloudflare’s sub-processor for its AI gateway, under Cloudflare’s data processing agreement with us.
- Gets: The prompt and the image size, when someone asks for a generated image.
- Outside the EU: Cloudflare’s data processing agreement, with the EU’s standard contractual clauses; EU–US Data Privacy Framework.
- X.AI Corp. · United States
- Turns dictation into text (xAI’s speech-to-text model), reached through Cloudflare’s AI gateway. Cloudflare’s sub-processor for its AI gateway, under Cloudflare’s data processing agreement with us.
- Gets: The recording of what someone dictates.
- Outside the EU: Cloudflare’s data processing agreement, with the EU’s standard contractual clauses.
- Stripe · Ireland and the United States
- Takes payments for paid plans and keeps their records.
- Gets: The buyer’s name, email address, billing address, VAT number if any, payment details, the plan and the amounts.
- Outside the EU: Stripe’s data processing agreement, with the EU’s standard contractual clauses; EU–US Data Privacy Framework.
- Google (Google Workspace) · Ireland and the United States
- Hosts the mailbox that receives what people write to hello@repen.app.
- Gets: What you write to us, and your email address.
- Outside the EU: Google’s data processing terms, with the EU’s standard contractual clauses; EU–US Data Privacy Framework.
Only when you choose them
These aren’t our sub-processors, but get data when you or your agents use them: stock photo providers (the search words), Google when you sign in with Google, your agents’ providers (what the agent reads, under your agreement with them), and Have I Been Pwned (the first five characters of a one-way hash of a new password).