Home/Legal/Sub-Processors

Exporb Sub-Processors

Under GDPR Article 28, we are required to disclose all third-party data processors (sub-processors) that handle personal data on behalf of Exporb and our customers. This list is kept current as of July 1, 2026.

About This List

Exporb (Aeon Kosmos, LLC) acts as a data processor for our customers' personal data. When we engage third-party services to assist in delivering Exporb, these services become sub-processors under GDPR. We conduct security and privacy assessments before engaging any sub-processor and require each to maintain a Data Processing Agreement (DPA) with us.

Notification of changes: We will notify existing customers via email at least 14 days before adding or replacing a sub-processor. Customers may object to a new sub-processor within that window by contacting privacy@exporb.com.

Supabase↗

Purpose

Database hosting, authentication, file storage, real-time sync

Location

US East (us-east-1)

Data Categories

User profile data, contact records, audio recordings, photos, notes, auth tokens, exhibition metadata

DPA →

Vercel↗

Purpose

Application hosting, serverless API functions, edge CDN

Location

US East (iad1), Global (edge network)

Data Categories

Application logs, API request metadata, IP addresses

DPA →

Google (Gemini API)↗

Purpose

AI-powered audio transcription, contact information extraction, and meeting summarization

Location

Data Categories

Audio recordings and text transcripts (processed in transit; not stored by Google per Gemini API data processing terms)

DPA →

Stripe↗

Purpose

Payment processing, subscription management, invoicing

Location

US, Global

Data Categories

Payment card details (tokenized), billing address, transaction history, subscription metadata

DPA →

Sentry↗

Purpose

Error monitoring and crash reporting

Location

Data Categories

Error stack traces, browser metadata, anonymized user IDs for error correlation

DPA →

PostHog↗

Purpose

Product analytics, feature flags, session recordings

Location

US, EU

Data Categories

Usage patterns, feature interaction events, anonymized session data; session recordings disabled

DPA →

Cloudflare↗

Purpose

CDN, DDoS protection, DNS, web analytics (Insights)

Location

Global (280+ data centers)

Data Categories

Network traffic metadata, DNS query logs, anonymized web analytics

DPA →

trigger.dev↗

Purpose

Background AI job processing — runs enrichment and analysis tasks triggered by user actions

Location

Data Categories

Contact records and audio metadata (processed in transit for AI enrichment; not persistently stored by trigger.dev)

DPA →

RevenueCat↗

Purpose

Mobile subscription management, purchase verification across iOS App Store and Google Play

Location

Data Categories

Subscription status, purchase tokens, app user ID (anonymous)

DPA →

Questions about our sub-processors? privacy@exporb.com