Subprocessors

The providers that receive personal data when you use TopoTopic: what each receives, when, and where.

Last updated 1 October 2026.

1. Overview

This page lists every provider that receives personal data when you use TopoTopic, what it receives, when, and where. The Privacy Policy explains the purposes, the legal bases and the safeguards for transfers outside the European Economic Area.

A processor handles personal data only on our instructions under a data-processing agreement. An independent controller decides for itself how it handles the data it receives and is responsible for it under its own privacy notice.

We update this page before a new provider receives personal data. Questions: support@topotopic.com.

2. Providers that receive personal data

Amazon Web Services (AWS)

Role: Processor
Purpose: Hosting, databases, file storage, background workers, the relay server for calls, OpenAI language models and web search through Bedrock, content delivery and web application firewall (CloudFront, WAF), transactional email delivery (SES), and the mailboxes that receive your correspondence (WorkMail)
Data: All account data, workspace content and media, service metadata, request metadata at the network edge, the search queries the assistant writes, account emails, and messages you send us
When: Always; Bedrock when you use an AI feature
Location and transfer safeguard: EU (Ireland, eu-west-1) for primary storage, application servers and the call relay; United States (Northern Virginia and Oregon) for Bedrock language models and web search. Requests pass through the CloudFront edge location nearest to you, which can be outside the EU. AWS keeps Bedrock requests that its abuse detection flags for up to 30 days and does not share them with the model provider. AWS data-processing terms govern international transfers

OpenAI

Role: Processor
Purpose: Direct APIs for the voice assistant, Live and translated calls, transcription and speaker labeling for some languages and paths, text to speech for Listen and read-aloud, embeddings, and memo thumbnails. Language models are accessed through AWS Bedrock
Data: Audio, text, document excerpts, the recent part of an assistant conversation, a memo's title, summary and keywords for its thumbnail, a pseudonymous account identifier, metadata about assistant tool calls, and, for opt-in voice recognition, your voice reference clip with the display names used to label matched speakers. For the voice assistant, Live and translated calls your browser sends audio to OpenAI directly
When: When you use a feature that needs it
Location and transfer safeguard: United States. OpenAI Ireland Ltd is the contracting entity for EEA customers; onward transfers rely on the EU-US Data Privacy Framework where OpenAI's certification covers the service, and otherwise on EU Standard Contractual Clauses

AssemblyAI

Role: Processor
Purpose: Live speech to text, transcription of uploaded files, and speaker labeling
Data: Audio and timing metadata
When: When you record or upload audio or video
Location and transfer safeguard: United States. Live transcription can use EU endpoints only when our servers can tell that a request comes from the EU, which at present they cannot. EU Standard Contractual Clauses

Google (Sign-In, Calendar, YouTube, Fonts)

Role: Independent controller
Purpose: Google sign-in; calendar events for your reminders, for tasks with a due date and for events you approve; YouTube imports, through YouTube API Services and our own account; the YouTube player and thumbnails shown for YouTube links in messages; and fonts for share images
Data: Account identifiers, authorization tokens, the calendar events the Service creates for you, public video metadata and captions, your IP address when your browser loads a YouTube player or thumbnail, and, from our servers, the characters a share image needs in a script our fonts do not cover
When: When you sign in with Google, connect Google Calendar, import from YouTube, view a message with a YouTube link, or share a page whose title needs such a font
Location and transfer safeguard: United States and other Google locations. EU-US Data Privacy Framework and EU Standard Contractual Clauses under Google's terms

Google (public STUN server)

Role: Independent controller
Purpose: Helps your browser find a network path when it sets up a Live session or a translated call
Data: Your IP address and port. No audio, text or account data
When: When your browser sets up one of those connections
Location and transfer safeguard: Google's global network

Google Analytics 4 and Google Ads measurement

Role: Processor, and independent controller for the purposes Google states in its own terms
Purpose: Optional product analytics and measurement of which advertisements lead to sign-ups. No advertising personalization
Data: Measurement identifiers, the full page address, event information, and any available advertisement click identifier; some sign-up and first-use events are also sent from our servers with the same identifier, or with one derived from our analytics session when the browser has none
When: Only while you have analytics enabled
Location and transfer safeguard: United States and other Google locations. EU-US Data Privacy Framework and EU Standard Contractual Clauses under Google's terms

Supadata (Dumpling Software UG)

Role: Processor
Purpose: Retrieves transcripts, captions and page text for links you import, creates a transcript with AI for video, podcast and social media links that have none, and is the first caption source for YouTube imports
Data: The URL you import, public or user-authorized page and media metadata, transcript or caption text, and job metadata
When: When you import a link
Location and transfer safeguard: Provider established in Germany. We have not verified where all of its processing takes place; its terms govern onward processing

PostHog

Role: Processor
Purpose: Optional product analytics and masked session replay, as the Privacy Policy describes
Data: Usage events, analytics identifiers, masked replays, your IP address, which our configuration keeps with each event, and, when you are signed in, an internal account identifier and a pseudonymous workspace identifier with account class, plan, product surface, release, environment and first-visit attribution. Not your email, display name, handle or avatar
When: Only while you have analytics enabled
Location and transfer safeguard: United States (PostHog US Cloud), reached through our own domain, which passes on your IP address. EU Standard Contractual Clauses and the EU-US Data Privacy Framework under PostHog's terms

Sentry

Role: Processor
Purpose: Error monitoring and reliability diagnostics
Data: Error events, stack traces and runtime metadata, with emails, tokens, cookie values and internal identifiers redacted and without your IP address
When: When an error occurs
Location and transfer safeguard: EU ingestion (Germany). Sentry's data-processing terms govern onward transfers

A regional endpoint describes where data is first sent. It does not by itself establish where a provider carries out every support, security or onward-processing activity.

OpenAI retention. Our API configuration does not guarantee zero data retention. OpenAI may keep API content in abuse-monitoring logs for up to 30 days, and other retention can apply under its terms. Language-model requests through AWS Bedrock disable response-state storage with store: false.

3. Integrated but not enabled

The Service contains integrations that are not enabled in production. No personal data is sent to these providers. A provider moves into section 2 before its integration is enabled.

Stripe (Stripe Payments Europe Ltd): Subscription billing, invoices and the hosted billing portal. Paid plans are not offered, and the product shows no checkout.
Google Gemini: Locating passages on rendered document pages, and AI parsing of uploaded images. No credential is configured in production, so these paths do not run.
Slack (Salesforce): Alerts to the operator about service health, reports and costs. No Slack destination is configured; operational alerts reach the operator by email.

4. Sites we fetch for you

When you import a link, or a message contains one, our servers request it from the site concerned, for example YouTube, Dropbox shared links, arXiv, or any other web address. When the assistant searches the web for you, AWS can fetch public pages in the same way. That site sees a request from TopoTopic or AWS for the address, not your identity. It handles the request under its own terms and is not our processor.

5. Operator tools that receive no user content

We use UptimeRobot to monitor availability and Google Search Console to see how public pages appear in search. Neither receives account data or workspace content.