Verdiktum — Sub-processors
Version: 1.0 · Last updated: 31 May 2026
List of third-party providers processing data on behalf of HOOGO – Tomasz Kulesza for the Verdiktum service. Keep this list current whenever a provider changes.
Note: Verify and complete actual providers and server locations after production setup. Which email provider (Postmark / Resend / SES) is active depends on the
MAIL_MAILERenvironment setting.
| Provider | Function | Data categories | Location / transfer |
|---|---|---|---|
| Stripe | Payments & subscriptions | customer ID, payment method (last 4), billing data | EU/US — SCC / DPF |
| Postmark / Resend / Amazon SES (active per config) | Transactional email & newsletter | email address, message content | EU/US — SCC / DPF |
| Anthropic (Claude) | Analysis generation/verification | analysed content (claims, transcripts); no user-identifying data in content | US — SCC |
| Google (Gemini) | Content translation | content to translate | EU/US — SCC / DPF |
| Groq (Whisper) | Audio transcription | audio/text of public recordings | US — SCC |
| OVH (OVH Sp. z o.o., Wrocław / OVH SAS) | Hosting & infrastructure | all application data (storage) | European Union (Poland/France) — within the EEA, no transfer outside the EEA |
| Plausible Analytics | Aggregated statistics (no cookies, no profiling) | anonymised traffic data | EU (EU-hosted) |
| Slack | Internal operational notifications | system events (no sensitive user data) | US — SCC / DPF |
| YouTube / Google API | Sourcing public material | public video IDs, transcripts | US |
Transfers outside the EEA
Transfers to the US rely on an adequacy decision (EU–US Data Privacy Framework, where the provider is certified) or Standard Contractual Clauses (SCCs) with supplementary safeguards.
Data Processing Agreements (DPAs)
A DPA must be in place with each processor of personal data (usually available in the provider's dashboard/terms).
Controller: Tomasz Kulesza (HOOGO – Tomasz Kulesza), ul. Graniczna 53C lok. 47, 40-018 Katowice, Poland.