Subprocessors
These are the companies that handle personal data for us to run Klusko. There are four of them, and one only gets involved if you search for a GIF.
A subprocessor is a company we use to process personal data in your workspace on your behalf. We have a contract with each one, and each one only gets the data it needs for its job. Our data processing terms set out the rules they’re held to.
Current subprocessors
| Name | Purpose | Data | Location | Transfer mechanism |
|---|---|---|---|---|
| Supabase Inc. | Database, sign-in and file storage | All workspace content, account data and files | Hosted on AWS in eu-central-1 (Frankfurt, Germany) | Stored in the EU, which the UK treats as adequate. For any access from the US: UK Extension to the EU-US Data Privacy Framework where the provider is certified, otherwise the ICO’s International Data Transfer Addendum |
| Railway Corporation | Hosting and delivery of the web app | Data passing between your browser and the database while you use the app | United States | UK Extension to the EU-US Data Privacy Framework where the provider is certified, otherwise the ICO’s International Data Transfer Addendum |
| Resend | Transactional email (confirmations, invitations, password resets) | Recipient’s name and email address, and the email content | United States | UK Extension to the EU-US Data Privacy Framework where the provider is certified, otherwise the ICO’s International Data Transfer Addendum |
| GIPHY | GIF search in chat, only when a user opens it | Search terms and the user’s IP address | United States | UK Extension to the EU-US Data Privacy Framework where the provider is certified, otherwise the ICO’s International Data Transfer Addendum |
The International Data Transfer Addendum is used with the EU Standard Contractual Clauses.
Coming later
Billing hasn’t launched yet, because every plan is free during early access. When it launches, we’ll add a payment provider to this list. Card details will go to that provider, not to us.
When the list changes
Before we add or replace a subprocessor, we’ll update this page and email the Admins of every account at least 30 days before the change. If you have a reasonable data protection objection, email privacy@klusko.com within those 30 days. Section 6 of the data processing terms explains what happens next.
More about how we handle data is in our privacy policy and on the security page.