Sub-processors
Last updated: 10 November 2026
The short version. Four providers process personal data for Cerebro: Supabase (database and sign-in), Google Cloud (servers), Anthropic (AI that reads catalogue structure, never buyers' details) and Resend (email). Data is stored in the European Union. Stripe handles invoices and payouts as an independent controller. We announce any new sub-processor here at least 30 days before it starts.
A sub-processor is a company Cerebro engages to process personal data on its behalf. This page lists them, for the personal data Cerebro processes as a controller and for the Buyers' details it processes on behalf of Sellers under section 12 of our terms of service. Each is bound by a written contract that requires it to process the data only on our instructions, keep it confidential and secure, help us meet our obligations, and delete or return it at the end of the service.
1. Current sub-processors
| Provider | Purpose | Personal data | Location of processing | Safeguard for transfers |
|---|---|---|---|---|
| Supabase | Database hosting; sign-in and second-factor authentication | Account, member and organisation data; Sales records; Buyers' details until deleted 90 days after the Sale | European Union (Ireland, eu-west-1); provider support may access from outside the EEA | Standard Contractual Clauses (Modules 2 and 3), with UK and Swiss addenda, in the provider's data processing agreement |
| Google Cloud | Hosting and running Cerebro's servers and scheduled jobs | All data the servers handle, in transit and in memory | European Union (Belgium, europe-west1) | Google Cloud data processing addendum with Standard Contractual Clauses; EU–US Data Privacy Framework where applicable |
| Anthropic | AI model that reads samples of Sellers' catalogue data to propose how it maps, and writes questions about it | Catalogue records only, which may include a staff member's name where a Seller's catalogue contains it; never Buyers' details | United States | Anthropic's data processing addendum (incorporated in its commercial terms) with Standard Contractual Clauses; EU–US Data Privacy Framework where certified |
| Resend | Sending email: notices to members and organisations, invitations, live review outcomes, and replies to people who contact us | Names and email addresses of recipients, and the content of those messages | United States | Resend's data processing agreement with Standard Contractual Clauses; EU–US Data Privacy Framework where certified |
2. Independent controllers
Stripe issues our invoices and pays Agent Builders their share. For the identity, tax and bank details it collects to make payouts, and for its own legal duties such as verifying who receives money, Stripe acts as an independent controller under its own privacy policy, not as our sub-processor.
Sellers and Agent Builders are independent of Cerebro. A Seller is the controller of the Buyers' details it receives to complete a Sale; an Agent Builder is the controller of its users' data. Neither is our sub-processor.
3. Where data is stored
Cerebro's database is in Ireland and its servers in Belgium, both in the European Union. Data reaches the United States only where a provider above is based there or provides support from there, and then under the safeguards listed. Buyers' details are stored only in the European Union, and Cerebro never sends them by email or to an AI model.
4. How we choose and oversee sub-processors
- We assess each provider's security, data protection commitments and certifications before engaging it.
- We give each only the data its purpose needs: for example, Anthropic receives catalogue samples, never Buyers' details.
- We sign or accept each provider's data processing agreement, and keep a record of the safeguards for each transfer, with a transfer assessment where we rely on Standard Contractual Clauses.
- We review this list when our providers or their terms change.
5. Changes to this list
We update this page at least 30 days before a new sub-processor starts processing personal data, and change the date at the top. Sellers with whom we process Buyers' details are also told by email, if they ask to be: write to privacy@cerebro.one with the subject "Sub-processor updates". A Seller may object to a new sub-processor within 14 days on reasonable data protection grounds, as section 12 of our terms of service provides.
6. Contact
Questions about our sub-processors, or a copy of the safeguards for a transfer: privacy@cerebro.one.