AirStrings (Symbionix SL, Barcelona, Spain) uses a small number of trusted third parties ("subprocessors") to help deliver the Service. Each processes personal data on our behalf under a written contract that includes appropriate data-protection terms and, where the subprocessor is located outside the European Economic Area (EEA), appropriate safeguards for international transfers.
This page is referenced by our Data Processing Agreement and forms part of it. It supplements the Privacy Policy, which describes these subprocessors by category.
Current subprocessors
| Subprocessor | Purpose | Data categories | Region | Transfer mechanism |
|---|---|---|---|---|
| Railway (Railway Corp.) | Application hosting and compute for the AirStrings backend | Account, authentication, usage and log data; Customer Content in transit through the application | United States | SCCs (and, where applicable, the EU–US Data Privacy Framework) |
| Neon (Neon Inc.) | Managed PostgreSQL database storing Service metadata | Account, authentication, project and string metadata, billing metadata | United States / EU | SCCs (and, where applicable, the EU–US Data Privacy Framework) |
| Cloudflare (Cloudflare, Inc.) | CDN delivery and R2 object storage of signed bundles | Customer Content in signed bundles; request metadata and IP addresses at the edge | United States (global edge network) | SCCs (and, where applicable, the EU–US Data Privacy Framework) |
| Stripe (Stripe, Inc. / Stripe Payments Europe) | Payment processing, subscriptions, invoicing, tax | Billing contact, payment method (held by Stripe), transaction and invoice data | United States / Ireland | SCCs (and, where applicable, the EU–US Data Privacy Framework) |
| Resend (Plus Five Five, Inc.) | Transactional and notification email (for example, team invitations, account and security notices) | Recipient email address, message content and metadata | United States | SCCs (and, where applicable, the EU–US Data Privacy Framework) |
The transfer mechanism shown is the safeguard each subprocessor relies on for transfers of EEA personal data to a third country. AirStrings is the data exporter to these subprocessors, with the Standard Contractual Clauses (SCCs) as the primary safeguard.
Changes and how we notify you
We may add or replace subprocessors as the Service evolves. When we do, we will give affected customers at least 30 days' advance notice before the new subprocessor begins processing Customer Personal Data.
To receive change notifications, subscribe by emailing support@airstrings.com with the subject "Subprocessors".
As described in the DPA, a customer may object to a new subprocessor on reasonable data-protection grounds within 30 days of the notice. If we cannot resolve the objection, the customer may terminate the affected part of the Service and receive a refund of prepaid, unused fees for that portion.
Questions
For questions about our subprocessors or data protection, contact support@airstrings.com (subject: "Subprocessors").