Legal
Sub-processors
Every third party that receives personal information from bushido, what it is used for, and where it goes.
This list is generated from packages/use-cases/src/privacy/processorRegistry.ts, the registry the engineering team maintains alongside the code that sends the data. A continuous check fails the build when an integration sends personal information without a corresponding entry, so this page cannot quietly fall behind the product.
The agreement column reports what is on file today. Where it reads "standard terms published by the provider", bushido has not countersigned a data processing agreement. That column is a status report, not a claim that Art. 28 contracts are in force.
See our Privacy Policy for what each category of information is used for.
| Provider | Role | Purpose / data received | Region | Transfer safeguard | Agreement | Their sub-processors |
|---|---|---|---|---|---|---|
| Audible Magic (recogniser / fingerprinter) | Sub-processor | audio-content-and-fingerprint, work-identifiers | us | EU Standard Contractual Clauses (2021) | No agreement on file | — |
| Audioshake | Sub-processor | audio-content-and-fingerprint | us | EU Standard Contractual Clauses (2021) | No agreement on file | transloadit |
| AWS (S3 / CloudFront / Secrets Manager / KMS / CloudWatch) | Processor | audio-content-and-fingerprint, media-files, secrets, logs | us-east-1 | EU Standard Contractual Clauses (2021) | Standard terms published by the provider, not yet countersigned | — |
| Dropbox | Processor | file-names, file-paths | us | EU Standard Contractual Clauses (2021) | Standard terms published by the provider, not yet countersigned | — |
| Eventbrite | Independent controller | direct-pii, account-email, order-data | us | EU Standard Contractual Clauses (2021) | Standard terms published by the provider, not yet countersigned | — |
| Facebook SDK / Pixel | Processor | behavioural, ip-address, user-agent | us | EU Standard Contractual Clauses (2021) | Standard terms published by the provider, not yet countersigned | — |
| Firebase Dynamic Links | Processor | urls | us | EU Standard Contractual Clauses (2021) | Standard terms published by the provider, not yet countersigned | — |
| GetStream (chat) | Processor | pseudonymous, chat-content, attachments | us | EU Standard Contractual Clauses (2021) | Standard terms published by the provider, not yet countersigned | — |
| Google Ads | Processor | secret, oauth-tokens, ad-account-ids, behavioural | us | EU Standard Contractual Clauses (2021) | Standard terms published by the provider, not yet countersigned | — |
| Google Gemini + Vercel AI Gateway | Processor | free-text-incidental, campaign-copy | us | EU Standard Contractual Clauses (2021) | Standard terms published by the provider, not yet countersigned | vercel-hosting |
| Google Maps | Processor | direct-pii, address-text | us | EU Standard Contractual Clauses (2021) | Standard terms published by the provider, not yet countersigned | — |
| Google YouTube Data API | Processor | secret, oauth-tokens | us | EU Standard Contractual Clauses (2021) | Standard terms published by the provider, not yet countersigned | — |
| Graphite engine (first-party) | Processor | audio-content-and-fingerprint, rights-holder-names | us | Operated by bushido — no transfer to a third party | Not applicable — operated by bushido | aws |
| Higgsfield | Processor | audio-content-and-fingerprint, prompts | unknown | EU Standard Contractual Clauses (2021) | No agreement on file | — |
| Highlight.io | Former processor | behavioural, session-replay, ip-address | us | EU Standard Contractual Clauses (2021) | No longer receives data | — |
| Holy Grail (first-party metadata proxy) | Processor | work-identifiers | us | Operated by bushido — no transfer to a third party | Not applicable — operated by bushido | songstats |
| Jina (r.jina.ai) | Processor | urls | unknown | EU Standard Contractual Clauses (2021) | No agreement on file | — |
| Meta (Facebook / Instagram ads & content APIs) | Processor | secret, oauth-tokens, ad-account-ids | us | EU Standard Contractual Clauses (2021) | Standard terms published by the provider, not yet countersigned | — |
| Mux | Processor | audio-content-and-fingerprint, playback-signals | us | EU Standard Contractual Clauses (2021) | Standard terms published by the provider, not yet countersigned | — |
| Neon (Postgres) | Processor | direct-pii, secret, behavioural, free-text-incidental | us-east-1 | EU Standard Contractual Clauses (2021) | Standard terms published by the provider, not yet countersigned | aws |
| New Relic | Processor | behavioural, ip-address, user-agent, request-urls | us | EU Standard Contractual Clauses (2021) | Standard terms published by the provider, not yet countersigned | — |
| OpenAI | Processor | free-text-incidental | us | EU Standard Contractual Clauses (2021) | Standard terms published by the provider, not yet countersigned | — |
| OpenSign | Processor | direct-pii, account-email, contract-pdf | us | EU Standard Contractual Clauses (2021) | No agreement on file | — |
| Plausible | Processor | behavioural | eu | EU Standard Contractual Clauses (2021) | Standard terms published by the provider, not yet countersigned | — |
| Postmark | Processor | direct-pii, account-email, free-text-incidental | us | EU Standard Contractual Clauses (2021) | Standard terms published by the provider, not yet countersigned | — |
| Puppeteer / Chromium (server-side rendering) | Not a recipient | direct-pii, contract-pdf | local | No personal data transferred | Not applicable — operated by bushido | — |
| Sign in with Apple | Independent controller | direct-pii, account-email | us | EU Standard Contractual Clauses (2021) | Standard terms published by the provider, not yet countersigned | — |
| Sign in with Google | Independent controller | direct-pii, account-email | us | EU Standard Contractual Clauses (2021) | Standard terms published by the provider, not yet countersigned | — |
| Slack (incoming webhooks) | Processor | direct-pii, account-email | us | EU Standard Contractual Clauses (2021) | Standard terms published by the provider, not yet countersigned | — |
| Songstats | Processor | work-identifiers | us | EU Standard Contractual Clauses (2021) | No agreement on file | — |
| Spotify | Processor | secret, oauth-tokens, ad-account-ids | us | EU Standard Contractual Clauses (2021) | Standard terms published by the provider, not yet countersigned | — |
| Stripe | Processor | direct-pii, account-email, payment-identifiers | us | EU Standard Contractual Clauses (2021) | Standard terms published by the provider, not yet countersigned | — |
| TikTok | Processor | secret, oauth-tokens, ad-account-ids | global | EU Standard Contractual Clauses (2021) | Standard terms published by the provider, not yet countersigned | — |
| Transloadit | Sub-processor | audio-content-and-fingerprint, media-files | us | EU Standard Contractual Clauses (2021) | Standard terms published by the provider, not yet countersigned | aws |
| Twilio | Processor | direct-pii, phone-number, message-body | us | EU Standard Contractual Clauses (2021) | Standard terms published by the provider, not yet countersigned | — |
| Vercel (hosting / edge / logs) | Processor | ip-address, request-urls, account-identifiers | us | EU Standard Contractual Clauses (2021) | Standard terms published by the provider, not yet countersigned | aws |
| Vercel Analytics / Speed Insights | Processor | behavioural, ip-address, web-vitals | us | EU Standard Contractual Clauses (2021) | Standard terms published by the provider, not yet countersigned | — |