DRAFT — pending legal review. Not final counsel-approved wording.
Subprocessors
Version 2.0.0 · Effective 2026-08-01 · Last updated 2026-07-25
Previous versions
- 1.0.0 · 2026-07-25 — First published draft. Application Insights removed as it is not in use; API Management added.
These are the processors that may process personal data on behalf of JMS Sieracki sp. z o.o. in connection with CramDeck. Each has a written data processing agreement with us, as required by Article 28 GDPR.
TODO(facts) — the Azure region column must be confirmed against the actual deployment before this page is
approved.
Infrastructure and identity
| Processor | Contracting entity | What it processes | Where | Transfer safeguard |
|---|---|---|---|---|
| Microsoft Entra External ID | Microsoft Ireland Operations Ltd, Dublin, Ireland | Email address, name, authentication events, identity tokens | EU TODO(facts) | EU Data Boundary; DPF certification and Standard Contractual Clauses in the Microsoft DPA for any support access from outside the EEA |
| Azure Cosmos DB | Microsoft Ireland Operations Ltd | Profiles, decks, cards, favourites, groups, study state, media metadata | EU TODO(facts) | As above |
| Azure Database for PostgreSQL | Microsoft Ireland Operations Ltd | Accounts, sessions, billing metadata, integration tokens, consent records, audit log, content reports | EU TODO(facts) — confirm whether production PostgreSQL is Azure-managed or self-hosted | As above |
| Azure Blob Storage | Microsoft Ireland Operations Ltd | Uploaded images and other media | EU TODO(facts) | As above |
| Azure Key Vault | Microsoft Ireland Operations Ltd | Application secrets only; no end-user content | EU TODO(facts) | As above |
| Azure API Management | Microsoft Ireland Operations Ltd | Feed requests proxied through our API gateway, including request metadata | EU TODO(facts) | As above |
AI
| Processor | Contracting entity | What it processes | Where | Transfer safeguard |
|---|---|---|---|---|
| Azure OpenAI Service | Microsoft Ireland Operations Ltd | Prompts you submit to the AI deck wizard and the generated output. Not used to train models. Flagged content may be retained up to 30 days for abuse review by EEA-based reviewers | EU TODO(facts) | EU Data Boundary; DPF and Standard Contractual Clauses |
| Azure AI Content Safety | Microsoft Ireland Operations Ltd | Generated text submitted for harm classification | EU TODO(facts) | As above |
Payments
| Processor | Contracting entity | What it processes | Where | Transfer safeguard |
|---|---|---|---|---|
| Stripe | Stripe Payments Europe, Ltd., Dublin, Ireland, with Stripe, Inc., USA | Customer identifier, email, name, amounts, currency, purchased items, subscription state. Card numbers are handled by Stripe and never reach us | Ireland, with access from the USA | EU-US Data Privacy Framework certification and Standard Contractual Clauses in the Stripe DPA |
Optional, only with your consent
| Processor | Contracting entity | What it processes | Where | Transfer safeguard |
|---|---|---|---|---|
| Google Tag Manager and Google Analytics | Google Ireland Limited, Dublin, Ireland, with Google LLC, USA | Usage events, device and browser data, approximate location, consent state. Loaded only after you opt in to analytics cookies | Ireland, with access from the USA | EU-US Data Privacy Framework certification and Standard Contractual Clauses in the Google Ads Data Processing Terms |
Optional, only if you connect the integration
| Processor | Contracting entity | What it processes | Where | Transfer safeguard |
|---|---|---|---|---|
| OpenAI (ChatGPT agent platform) | OpenAI Ireland Ltd, Dublin, Ireland, with OpenAI, L.L.C., USA | Account linking and the input and output of the tools you authorise the agent to call | Ireland, with access from the USA | Standard Contractual Clauses in the OpenAI Data Processing Addendum |
Not in use
Azure Application Insights appeared on earlier versions of this page. The telemetry SDK is not installed and no telemetry is sent. It will be added back here before it is enabled.
Changes
We will update this page when we add or replace a material processor, and we will note the change in the version history above. If you object to a new processor, you may terminate your account before the change takes effect. Contact: hello@cramdeck.com.