← Data Processing Addendum
Sub-processors
The third parties that process personal data on The Workaround Collective’s behalf. To request copies of the relevant DPAs / transfer safeguards, email info@theworkaroundcollective.com.
Currently active
These providers run the live platform and process personal data today.
| Sub-processor | Purpose | Personal data | Location / transfer safeguard |
|---|---|---|---|
| Vercel Inc. | Application hosting & content delivery (CDN) | Request/usage data in transit, server logs, IP address | US company; served from the EU (Frankfurt). DPA with EU SCCs. View DPA → |
| Neon Inc. | Managed PostgreSQL database (primary data store) | All application data (accounts, profiles, hives, bookings, etc.) | US company; data hosted in AWS eu-central-1 (Frankfurt, EU). DPA with EU SCCs. View DPA → |
| Microsoft 365 (Microsoft Corporation) | Transactional & verification email delivery (SMTP mailbox); Microsoft Teams backup video rooms, used only when a Buzz session's or a booked call's main video room isn't working | Recipient name & email address, message content (verification, resets, notifications). For a backup room: the display name a guest types, in-call audio & video, connection metadata (not recorded). A booked call's backup meeting is created with a generic title and the call time only, with no member names or emails. | Microsoft is a US company; transfers rely on the EU-US Data Privacy Framework and EU SCCs. WC's Microsoft 365 account is held directly with Microsoft (nonprofit plan). Backup rooms are organized by WC's info@ account, so no personal meeting links or accounts are exposed, and guests join without a Microsoft account. Buzz sessions use a few standing backup meetings; each booked 1:1 call gets its own one-off meeting, shown only to its two members during the call and deleted after it. View DPA → |
| Whereby | Private, one-time video rooms for booked mentor / creator / peer calls | Participant display name; in-call audio & video; connection metadata. Calls are not recorded. Each room is unique to a single booking and expires shortly after the call. | EEA-based provider (Norway). No personal meeting links or accounts are exposed — each party receives a room link scoped to their one call. DPA with EU SCCs. View DPA → |
Planned (with the feature they support)
These turn on when paid creator sessions launch.
| Sub-processor | Purpose | Personal data | Location / transfer safeguard |
|---|---|---|---|
| Stripe (incl. Stripe Connect) | Payments for creator sessions and creator payouts | Billing/payment data; creator bank & tax IDs (held by Stripe for KYC/1099, not by us) | US/EU. DPA with EU SCCs / EU-US Data Privacy Framework. |
| Google (Google Calendar API) | Optional calendar sync for members who connect their own Google Calendar: hide clashing open times, add booked calls to their calendar | The host's free/busy times (read); for each booked session, the time, session type and the guest's display name (e.g. “Jane D.”) written to the host's calendar. No guest email, no attendees. | US company; transfers rely on the EU-US Data Privacy Framework and EU SCCs. Only active for members who choose to connect. View DPA → |
| Microsoft (Microsoft Graph / Outlook Calendar) | Optional calendar sync for members who connect their own Outlook calendar: hide clashing open times, add booked calls to their calendar | The host's free/busy times (read); for each booked session, the time, session type and the guest's display name (e.g. “Jane D.”) written to the host's calendar. No guest email, no attendees, no Teams link. | US company; transfers rely on the EU-US Data Privacy Framework and EU SCCs. Only active for members who choose to connect. View DPA → |
Source code is stored on GitHub (USA); it does not contain production personal data. We aim to keep processing within the EU/EEA; where a provider is US-based, transfers rely on Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework via their DPA. See our Privacy Policy and DPA.