What is a sub-processor?
A sub-processor is a third-party service that processes personal data on our behalf to help us provide Screentour. We carefully select sub-processors that meet our security and privacy standards.
Current sub-processors
| Name | Headquartered | Datacenter Location | Purpose | Transfer safeguard | Actions |
|---|---|---|---|---|---|
| Fly.io | USA | EU (Frankfurt, Amsterdam) | Application hosting, PostgreSQL database, and infrastructure | SCCs (data in EU) | |
| Tigris | USA | EU (via Fly.io regions) | Object storage for file uploads | SCCs (data in EU) | |
| Cloudflare | USA | Global (EU data localization enabled) | DNS, CDN, and DDoS protection | SCCs | |
| Resend | USA | EU (Ireland) | Transactional email delivery and waitlist contact storage | SCCs (data in EU) | |
| Honeybadger | USA | EU (Frankfurt) | Error monitoring and uptime tracking | SCCs (data in EU) | |
| Plausible | Estonia | EU | Privacy-friendly, cookieless web analytics | EU (no transfer) | |
| Help Scout | USA | USA | Customer support management and in-app help | SCCs | |
| Userback | Australia | USA (AWS) | Product feedback collection | SCCs | |
| Mistral | France | EU (France) | AI language model for intelligent features | EU (no transfer) | |
| OpenAI | USA | USA | AI language model for intelligent features | SCCs | |
| Firecrawl | USA | USA | Web search, scraping and mapping | SCCs | |
| Tavily | USA / Israel | USA | Web search, scraping and mapping | SCCs | |
| Paddle | United Kingdom | UK / EU | Payments, billing, invoicing, and tax (Merchant of Record) | Independent controller; UK adequacy |
About transfer safeguards and Paddle
When personal data leaves the EU/EEA, we rely on Standard Contractual Clauses (SCCs) as the baseline, and on an adequacy decision where one applies, such as for the United Kingdom. A data-processing agreement on its own is not a transfer safeguard, so the table names the actual mechanism.
Paddle is our Merchant of Record. For payment and tax data it acts as an independent controller on its own account, not as a sub-processor working only on our instructions. We list it here so you have the full picture of who touches your data.
Our AI and search providers (Mistral, OpenAI, Firecrawl, Tavily) receive only non-personal festival names and search terms, never your account details, the content of your films, or your notes.
Changes to sub-processors
We'll update this page when we add or remove sub-processors. For significant changes that may affect how your data is processed, we'll notify you via email at least 30 days in advance.
Questions?
If you have questions about our sub-processors or data processing practices, email us at [email protected].