Sub-processors
Last updated 5 November 2026 ยท Slobal, Ireland
Taher Laskar trading as Slobal uses the processors below to run slobal.com and the services behind it. The first table is what is in use today, including the sign-in providers you can choose. The other tables list services you contract yourself. It is the list the data processing agreement refers to, and the privacy policy links here.
In use today
| Processor | Purpose | Data | Region | Status |
|---|---|---|---|---|
| Cloudflare | DNS, CDN and security proxy for slobal.com. Workers routing. R2 object storage for app and release files and nightly database backups | IP addresses and request metadata (DNS, CDN, Workers). Release files with no personal data (R2). Nightly database backups (R2) | Global network. The R2 bucket is stored in Western Europe (WEUR). It has no EU jurisdiction restriction, so the location is a hint, not a guarantee. Transfers rely on EU standard contractual clauses (SCCs) and the UK addendum, as set in the DPA, which also states that Cloudflare complies with the EU-US Data Privacy Framework. Cloudflare DPA | In use |
| Render | Hosting of the application services (the relay, the agncred API and the nightly jobs) | Account data (name, email), sign-in identifiers, push tokens, licence and subscription records, connection metadata, IP addresses in logs. The content you send between the Helmsly app and your own instance passes through in transit and is not stored | Frankfurt, EU. Render is certified under the EU-US Data Privacy Framework (see Render notice). The DPA also sets EU standard contractual clauses (SCCs). Render DPA | In use |
| Supabase | Managed Postgres database | The same account, licence and subscription records, stored in Postgres. Also the sign-in records, push tokens and profile pictures of the Helmsly app for iPhone | Frankfurt, EU (eu-central-1). Transfers rely on EU standard contractual clauses (SCCs) and the UK addendum, as set in the DPA. Supabase DPA | In use |
| Resend | Transactional email: sign-in, account and order messages. Open and click tracking are off. | Email address and the content of those messages | EU (Ireland, eu-west-1). Our sending domain is verified in that region. Transfers to Resend in the US use EU standard contractual clauses (SCCs) and the UK addendum, as set in the DPA, which also states that Resend complies with the EU-US Data Privacy Framework. Resend DPA | In use |
| Stripe | Sells licence orders as merchant of record (Stripe Managed Payments, shown as “Sold through Link”): payment, tax, receipts and payment support, through the Stripe hosted checkout page. Your browser is sent to Stripe to pay. No Stripe script loads on slobal.com. | Billing details, including the card, which we never hold | As stated in the provider’s terms | In use |
| Google (sign-in) | Sign-in with an existing account, only if you choose this provider on the sign-in or sign-up page | The sign-in request and the identity you approve at Google: your email address and name, as Google returns them. Google also sees your IP address when your browser is sent to it. | As stated in the provider’s terms | In use, only when you choose it |
| Facebook (sign-in) | Sign-in with an existing account, only if you choose this provider on the sign-in or sign-up page | The sign-in request and the identity you approve at Facebook: your email address and name, as Facebook returns them. Facebook also sees your IP address when your browser is sent to it. | As stated in the provider’s terms | In use, only when you choose it |
| Apple (sign-in) | Sign-in with an existing account, only if you choose this provider on the sign-in or sign-up page | The sign-in request and the identity you approve at Apple: your email address and name, as Apple returns them. Apple also sees your IP address when your browser is sent to it. | As stated in the provider’s terms | In use, only when you choose it |
| Microsoft account (sign-in) | Sign-in with an existing account, only if you choose this provider on the sign-in or sign-up page | The sign-in request and the identity you approve at Microsoft: your email address and name, as Microsoft returns them. Microsoft also sees your IP address when your browser is sent to it. This is separate from Microsoft 365 company mail below. | As stated in the provider’s terms | In use, only when you choose it |
| GitHub (sign-in) | Sign-in with an existing account, only if you choose this provider on the sign-in or sign-up page | The sign-in request and the identity you approve at GitHub: your email address and name, as GitHub returns them. GitHub also sees your IP address when your browser is sent to it. This is separate from GitHub code hosting below. | As stated in the provider’s terms | In use, only when you choose it |
| Apple Push Notification service | Delivery of alerts to the Helmsly app for iPhone, such as an approval request | The device token of your phone and the alert text. With Show Previews on (the default) that is a preview of the message or the approval | As stated in the provider’s terms | In use, only when you turn on alerts in the app |
| Microsoft 365 | Company mail, including support correspondence | Email address and the messages you send to us | As stated in the provider’s terms | In use |
| GitHub | Code hosting for our own software and documents | Source code and project documents. Customer content is not stored there. | As stated in the provider’s terms | In use |
Where a processor handles data outside the European Economic Area, the transfer relies on the EU standard contractual clauses or an adequacy decision. See section 8 of the data processing agreement.
Effective date: 22 October 2026. Retention: we keep account data while the account is open. A closed account stays dormant for two years and is then deleted, as the privacy policy sets out. Nightly database backups in Cloudflare R2 are kept for 30 days, and at least 7 backups are always kept. Privacy contact: support@slobal.com.
Notice of change
We add a dated line to the change log on this page and email the account holder before a new sub-processor starts to handle your data. This matches section 6 of the data processing agreement.
You can object by writing to support@slobal.com. If the objection cannot be resolved, you can cancel the affected service.
Messaging platforms you connect
| Processor | Purpose | Data | Region | Status |
|---|---|---|---|---|
| Meta (WhatsApp), Slack and Telegram | Messaging channels you connect to an agent | The messages on your own channels | As stated in each provider’s terms | The customer’s own processors, not Slobal’s. You contract them. |
WhatsApp messages pass through the Slobal relay in transit to your own install. The relay holds a message for at most 15 minutes if your install is offline and stores nothing at rest after delivery. Slack and Telegram messages go straight between the platform and your install and do not pass through the relay.
Services your device uses when you dictate
Slobal does not send these companies anything and does not engage them. They are the companies behind the speech engine of your own device or browser. They process your voice when you tap the mic in Helmsly and the engine is not running on your device, under their own terms. Slobal and the Helmsly hub receive no audio.
| Provider | When | Data | Slobal’s part |
|---|---|---|---|
| Dictating in Chrome without On-device only | Voice audio, to turn it into text | None. Chrome sends it. | |
| Microsoft | Dictating in Edge, or in the Windows app with Online speech recognition on | Voice audio, to turn it into text | None. Edge or Windows sends it. |
| Apple | Dictating in Safari, in the Mac app or in the iPhone app, when the language has no on-device model | Voice audio, to turn it into text | None. Safari or the Speech framework sends it. |
Model providers you choose
Helmsly is bring-your-own-model. You choose the model provider, such as Anthropic, OpenAI, Google or another, and you hold the contract and the key. Those providers are your own processors. They are not our sub-processors, and we do not send your prompts to them on our own account.
Change log
| Date | Change |
|---|---|
| 2026-09-24 | First published list: Contabo, Cloudflare, Resend, Microsoft 365 and GitHub in use. Stripe listed as not yet in use. |
| 2026-09-25 | Resend region stated as EU (Ireland, eu-west-1). Render (planned, Frankfurt, EU) listed as not in use. Meta (WhatsApp), Slack and Telegram listed as the customer’s own processors, not Slobal’s. The relay passes WhatsApp messages in transit and stores nothing at rest after delivery. Bug reports are held by Slobal as controller on our EU server (Contabo), with no new processor. |
| 2026-09-30 | Google, Facebook, Apple, Microsoft account and GitHub listed as sign-in providers. Each receives data only when you choose it to sign in. Resend noted as sending with open and click tracking off. Stripe described as a redirect to its hosted checkout page, with no Stripe script on this site. |
| 2026-10-22 | Render (application hosting, Frankfurt, EU), Supabase (managed Postgres database, Frankfurt, EU) and Cloudflare R2 (object storage) listed as in use. The Cloudflare row now covers Workers and R2. Contabo stays in use for this website and a stopped rollback copy until 5 November 2026. Stripe stays not yet in use. |
| 2026-10-28 | Contabo removed from the list. The website runs on Cloudflare and the rollback copy of the previous service is deleted, so Contabo no longer holds data for the services listed here. |
| 2026-11-03 | Stripe listed as in use, as merchant of record through Stripe Managed Payments. Prices include VAT where it applies, which Stripe charges and pays. |
| 2026-11-03 | Apple Push Notification service listed as in use, for alerts to the Helmsly app for iPhone. The privacy policy and the security page now name Render and Supabase in place of Contabo. Later the same day: alerts can carry a preview of the message or the approval, on by default, and the app can turn previews off. |
| 2026-11-03 | Google, Microsoft and Apple listed under “Services your device uses when you dictate”. They are not Slobal’s sub-processors and receive nothing from Slobal. They process audio only when you tap the mic and your device’s speech engine is not running on the device. |
| 2026-11-05 | Render and Supabase rows now state that they hold the sign-in records, push tokens and profile pictures of the Helmsly app for iPhone, and that message content passes through the relay in transit and is not stored. No new processor. |
We add a dated line here before a new processor, including Stripe, starts to handle personal data on your behalf. If you object to a change, write to support@slobal.com.