Sub-processors
The third parties that process personal data on our behalf.
Version 1.0 — in force as published, and kept current as the list changes.
This version will always be at https://legal.ripplefx.app/v/subprocessors-1.0/, whatever replaces it here.
Ripple Effect — Sub-processors, version 1.0 (English) In force as published, and kept current as the list changes.
The third parties that process personal data on our behalf, what each one is for, and where it does it.
This list exists separately from the Privacy Notice on purpose: changing a supplier should not require reissuing a notice, and a notice that has to be reissued to correct a supplier’s name is a notice that stays wrong for a while. The Privacy Notice points here, and here is where the list is kept current.
In use today
These process data for anyone who uses the application or visits the website.
| Provider | What it does for us | Processing location | Role |
|---|---|---|---|
| Supabase Inc. | Stores a crash report you chose to send; and, from Ripple Effect 1.5, usage statistics if you switch them on | United Kingdom (London) | Processor |
| Vercel Inc. | Hosts this site, ripplefx.app, docs.ripplefx.app and demo.ripplefx.app; the cookieless page statistics |
Global edge network; United States | Processor |
| GitHub, Inc. (Microsoft) | Hosts the release files the site links to, the published builds of the engine, and the public support repository | United States | Independent controller for requests made to it |
| Tally (Tally BV) | The waiting-list and satisfaction-survey forms | European Union (Belgium) | Processor |
| Forward Email LLC | Receives e-mail sent to our ripplefx.app addresses and passes it on to us — including whatever you send to legal@, such as a request to exercise your rights |
Not published by the provider; a United States company | Processor |
From the release that introduces the hosted service
These process nothing today. They are listed in advance so that the list is complete before the processing starts rather than after.
| Provider | What it will do for us | Processing location | Role |
|---|---|---|---|
| Supabase Inc. | Authentication, the account database, and the record of which terms you accepted | United Kingdom (London) | Processor |
| Amazon Web Services, Inc. | Object storage for project media synchronised to the service | Not yet selected | Processor |
| Resend (Plus Five Five, Inc.) | Delivers account e-mail: address confirmations, sign-in links, password resets and the notices we owe accountholders | United States | Processor |
| Polar Software Inc. | Merchant of Record: sells the subscription, collects payment, handles tax, issues receipts | United States | Independent controller for payment and billing data |
| Convergence host | The real-time collaboration server | Not yet selected | Processor |
| AI providers | Features that send content to a third party on an action you take | Not yet selected | Processor |
Polar is not our processor. It is the seller of record and decides, as a controller in its own right, what it does with the billing details you give it. We receive reports and payouts rather than your card details, and for tax purposes we invoice Polar rather than you. Its own privacy notice governs that data.
Forward Email is a forwarder, not a mailbox. Its own privacy policy says it does not write forwarded messages to disk or to a database and keeps no logs or IP addresses for them; what it does is hand the message on to us, after which it sits in our own mailbox like any other e-mail. It does not publish where its servers are, which is why the cell above says so rather than guessing, and it is a United States company — its terms are governed by the law of Delaware — so the transfer basis below is the one that applies to it.
There is no CAPTCHA provider. Sign-up is protected by a proof-of-work check that your device computes and our own server verifies, so no third party sees anything for it.
An AI provider is named here before a feature that uses one ships, never after, and we will not offer a feature from a provider that does not contractually agree that what is sent is not used to train its models.
Transfers outside the European Union
Where a provider processes data outside the European Economic Area, the transfer is made under Chapter V GDPR — but the basis is not the same one for all of them, and saying so matters more than keeping the sentence short.
- The United Kingdom, where our Supabase project runs, is covered by the European Commission’s adequacy decisions of 19 December 2025, which renewed the 2021 decisions until 27 December 2031. A transfer to a country the Commission has found adequate needs no further safeguard under article 45. Were that adequacy withdrawn, suspended or allowed to lapse, the transfer would fall back on the Standard Contractual Clauses in our data-processing agreement with the provider, which is why one is in place regardless.
- The United States — Vercel, GitHub, Resend, Polar, Forward Email — is covered for a given provider either by the EU–US Data Privacy Framework, the Commission’s adequacy decision of 10 July 2023, where that provider is certified under it, or otherwise by the Commission’s Standard Contractual Clauses under article 46, together with whatever supplementary measures our data-processing agreement with it sets out.
- The European Union is not a transfer. Tally processes in Belgium, and nothing leaves the Union for it.
Changes to this list
We will give thirty (30) days’ notice before a new sub-processor starts processing personal data on our behalf, by updating this page and — for accountholders — by e-mail. A business customer under a data-processing agreement may object to a new sub-processor within that period on reasonable data-protection grounds; if we cannot resolve the objection, that customer may terminate the affected part of the service and receive a pro-rata refund of the unused prepaid period.
Replacing a provider with another that does the same job under equivalent safeguards is treated the same way. Removing one is not, and takes effect when it happens.
This list is kept current rather than versioned on a schedule, and the notice period above is what protects you instead. It is a list of facts, not a set of terms: there is nothing here to accept, nothing that could be in force for one reader and not another, and no date on which it starts applying. It is in force as published. That is the whole reason it is a separate document from the Privacy Notice — a notice that had to be reissued to correct a supplier’s name is a notice that stays wrong for a while.
Every version of this list that has ever been in force stays published at its own permanent address. This one is at https://legal.ripplefx.app/v/subprocessors-1.0/.
Questions, or to be told when this list changes: legal@ripplefx.app.
ConnectingTheDots — William Karol Di Cioccio — VAT IT02224180667 — ripplefx.app