Sub-processors & DPA
Data Processing Addendum & sub-processor list · Effective October 2026
This DPA applies where PM3K ("Processor") processes personal data on behalf of a customer ("Controller") in connection with the Service, where the GDPR or a comparable law applies.
1. Processing details
| Element | Detail |
|---|---|
| Subject matter | Provision of the PM3K podcast production Service |
| Nature & purpose | Transcription, editing, mastering, storage, publishing of customer audio; account management |
| Categories of data | Email, name, uploaded audio/video, transcripts, show notes, usage logs |
| Data subjects | Customers and any individuals (e.g. guests) whose voice or image appears in customer content |
| Duration | For the term of the customer's agreement, then per the retention schedule in the Privacy Policy |
2. Processor obligations
- Process personal data only on the Controller's documented instructions.
- Ensure persons authorised to process the data are bound by confidentiality.
- Implement appropriate technical and organisational measures (TLS in transit, encryption at rest, hashed credentials, least-privilege access).
- Not engage a sub-processor without informing the Controller (list below).
- Assist the Controller in responding to data-subject requests and, where feasible, breach-notification obligations.
- Delete or return personal data on termination of the agreement.
- Make available information necessary to demonstrate compliance.
3. Sub-processors
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, compute, database (D1), object storage (R2), CDN | Global (primary US) | SCCs / DPA |
| DeepSeek / OpenRouter | AI transcription, editing, show notes, fact-check | Confirmed on contract | Confirmed on contract |
| Postiz | Social media scheduling (optional) | Confirmed on contract | Confirmed on contract |
| Stripe | Payment processing | US / EU | SCCs / DPA |
Each sub-processor is engaged under written terms that include data-protection obligations. Payment processor selection is subject to owner confirmation.
4. Security measures
- Authentication: PBKDF2-HMAC-SHA256 password hashing with per-user salt; session tokens and API keys stored only as hashes.
- Transport: TLS 1.2+ for all data in transit.
- At rest: encrypted storage via Cloudflare R2/D1.
- Access: least-privilege; no shared credentials; secrets in environment variables, never in code or logs.
- Release gate: no customer content is published without the customer's explicit approval; a hard quality-control failure blocks publication.
5. Breach notification
The Processor will notify the Controller without undue delay (and within 72 hours where feasible) after becoming aware of a personal-data breach affecting the Controller's data, and will cooperate in the Controller's own notification obligations.
6. Data-subject requests
The Processor will forward data-subject requests to the Controller and assist as required. Customers may request export or deletion of their data at any time via [email protected].
7. Termination
On termination, the Processor will delete or return all personal data per the retention schedule in the Privacy Policy, and will retain nothing beyond what is required by law.