Sub-processors
Version2026-05-27-v1List of sub-processors used by Mindmap Teams to deliver the Service. For each processor we publish the purpose, data category, region, DPA status, and own privacy link. Material changes (new processor, new region or new purpose) are announced at least thirty (30) days in advance via the contact address on /imprint.
Questions or objections? gdpr@mindmap.team.
Active sub-processors
Supabase
- Purpose
- Authentication, Postgres database, workshop metadata + transcripts
- Data
- Facilitator email, workshop content, transcript segments, consent rows
- Region
- EU (eu-west-1 / Ireland)
- DPA
- DPA with SCCs available (standard)
- Privacy policy
- https://supabase.com/privacy
Vercel
- Purpose
- Hosting of the web app (Next.js, edge + serverless functions)
- Data
- Connection metadata (IP, user agent, request logs)
- Region
- EU (fra1 / Frankfurt, pinned in vercel.json)
- DPA
- DPA with SCCs available
- Privacy policy
- https://vercel.com/legal/privacy-policy
Daily.co
- Purpose
- Real-time audio room (WebRTC SFU) for workshop participants
- Data
- Audio stream (in-transit only, not stored), connection metadata
- Region
- EU (Frankfurt)
- DPA
- DPA with SCCs available
- Privacy policy
- https://www.daily.co/privacy
Deepgram
- Purpose
- Speech-to-text on each participant's audio stream
- Data
- Audio fragments (real-time), resulting transcript text
- Region
- EU (Frankfurt — endpoint explicitly pinned to EU)
- DPA
- DPA with SCCs signed; opt-out of model training
- Privacy policy
- https://deepgram.com/privacy
Anthropic
- Purpose
- LLM (Claude) for command dispatch and transcript synthesis
- Data
- Transcript fragments, canvas snapshot in prompts
- Region
- Global endpoint — transfer outside EEA possible, covered by SCCs
- DPA
- DPA with SCCs available; no training on input by default
- Privacy policy
- https://www.anthropic.com/legal/privacy
Render
- Purpose
- Hosting of the Hocuspocus Yjs sync server
- Data
- Canvas state (CRDT updates), workshop ID, connection metadata
- Region
- EU (Frankfurt)
- DPA
- DPA with SCCs available
- Privacy policy
- https://render.com/privacy
Mollie
- Purpose
- Payment service provider (PSP) for subscription billing
- Data
- Subscriber name, billing address, payment method details, invoice amounts
- Region
- EU (Netherlands)
- DPA
- DPA with SCCs available; Mollie acts as an independent data controller for payment processing
- Privacy policy
- https://www.mollie.com/en/privacy
Planned sub-processors
The following parties have been announced but are not yet integrated into the live Service. They go live once the associated issues close.
Picovoiceplanned
- Purpose
- On-device wake-word detection ("Hey Mindmap") in the browser
- Status
- Not yet integrated — when enabled, detection runs locally in the browser without uploading audio