Sub-processors

The third parties that process personal data on The Workaround Collective’s behalf. To request copies of the relevant DPAs / transfer safeguards, email info@theworkaroundcollective.com.

Currently active

These providers run the live platform and process personal data today.

Sub-processor	Purpose	Personal data	Location / transfer safeguard
Vercel Inc.	Application hosting & content delivery (CDN)	Request/usage data in transit, server logs, IP address	US company; served from the EU (Frankfurt). DPA with EU SCCs. View DPA →
Neon Inc.	Managed PostgreSQL database (primary data store)	All application data (accounts, profiles, hives, bookings, etc.)	US company; data hosted in AWS eu-central-1 (Frankfurt, EU). DPA with EU SCCs. View DPA →
Microsoft 365 (Microsoft Corporation)	Transactional & verification email delivery (SMTP mailbox)	Recipient name & email address, message content (verification, resets, notifications)	Microsoft is a US company; transfers rely on the EU-US Data Privacy Framework and EU SCCs. The mailbox is purchased and administered through GoDaddy (reseller), which therefore has administrative access to it. View DPA →
Whereby	Private, one-time video rooms for booked mentor / creator / peer calls	Participant display name; in-call audio & video; connection metadata. Calls are not recorded. Each room is unique to a single booking and expires shortly after the call.	EEA-based provider (Norway). No personal meeting links or accounts are exposed — each party receives a room link scoped to their one call. DPA with EU SCCs. View DPA →

Planned (with the feature they support)

These turn on when paid creator sessions launch.

Sub-processor	Purpose	Personal data	Location / transfer safeguard
Stripe (incl. Stripe Connect)	Payments for creator sessions and creator payouts	Billing/payment data; creator bank & tax IDs (held by Stripe for KYC/1099, not by us)	US/EU. DPA with EU SCCs / EU-US Data Privacy Framework.

Source code is stored on GitHub (USA); it does not contain production personal data. We aim to keep processing within the EU/EEA; where a provider is US-based, transfers rely on Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework via their DPA. See our Privacy Policy and DPA.