Subprocessors
Version 0.1 (draft) · Draft — not yet in effect
Debrief (Löhr & Sørensen GmbH i.G., Hamburg, Germany) uses the subprocessors below to run the service. For an org's recordings they are subprocessors under the org's Data Processing Agreement; for account data they are our processors. We tell org admins at least 30 days before we add or replace a subprocessor of an org's recordings.
In use
| Subprocessor | Purpose | Personal data | Location | Transfer safeguard |
|---|---|---|---|---|
| Microsoft Ireland Operations Ltd (Microsoft Azure) | Hosting: the website and its jobs (Container Apps), the database (Azure Database for PostgreSQL), recordings, reports and backups (Blob Storage), secrets (Key Vault), application logs (Log Analytics), and the virtual servers that process recordings in the cloud when an org allows it (Virtual Machines) | All data Debrief stores (Privacy Policy, section 3); recordings with their sound while a cloud server processes them | EU: Sweden Central region. Microsoft may access data from outside the EU only as its EU Data Boundary allows (for example security and support) | Microsoft Products and Services Data Protection Addendum; EU Standard Contractual Clauses and the EU-US Data Privacy Framework for any access from outside the EU |
| Cloudflare, Inc. (Cloudflare DNS and Email Routing) | Runs the DNS of Debrief's domain; receives emails to Debrief's addresses and forwards them to our mailbox | Emails people send us (sender, content, attachments); no data of an org's recordings | United States and Cloudflare's global network | Cloudflare's Data Processing Addendum; the EU-US Data Privacy Framework and the EU Standard Contractual Clauses |
| Google (Gmail) | Our mailbox: stores the emails people send us and our answers | Emails and their senders; no data of an org's recordings | United States and other countries | The EU-US Data Privacy Framework and the EU Standard Contractual Clauses |
Cloudflare's DNS answers which address the domain has; it does not see the site's traffic (the site is not routed through Cloudflare).
Used for particular features
These process personal data only when the feature they serve is used.
| Subprocessor | Used when | Purpose | Personal data | Location | Transfer safeguard |
|---|---|---|---|---|---|
| Stripe Payments Europe, Limited (Dublin, Ireland) | an org buys a plan or report credits | Payments, subscriptions, invoices, refunds; the customer portal | The org's name, the buying admin's email, billing name and address, VAT number, payment status and invoices; card and other payment details are entered on Stripe's pages and never reach Debrief | EU, with transfers to Stripe, Inc. (United States) | Stripe's Data Processing Agreement; the EU-US Data Privacy Framework and the EU Standard Contractual Clauses. For its own legal duties (for example fraud prevention and anti-money-laundering checks) Stripe is an independent controller under its own privacy policy |
| Microsoft Ireland Operations Ltd (Azure Communication Services, Email) | Debrief sends an email (for example an invitation, an account or plan notice, a link a coach asked us to send) | Delivering emails | The recipient's email address and the email's content | EU (data location Europe) | as for Microsoft Azure above |
| Anthropic, PBC or Anthropic Ireland, Limited (Claude API; the contracting entity per Anthropic's commercial terms) | Debrief drafts an AI review for a coach's student, or an org's Coach report, on its own servers (instead of on the coach's or admin's PC, see below) | Writing the draft from the computed facts | The facts of the recording or org: statistics, flags, fights, player names; short quotes from voice comms transcripts only if transcripts are on; never video, audio or voice embeddings | United States | Anthropic's Data Processing Addendum with the EU Standard Contractual Clauses. According to Anthropic's commercial terms, Anthropic does not use data it receives through its API to train its models |
Not our subprocessors
- Anthropic (the Coach and coaches' reviews on their own PCs). An org's Coach runs on one of its admins' PCs with that admin's own Claude account, and a coach's AI-drafted student reviews on the coach's PC with the coach's own Claude account: that PC sends the statistics, player names and, while transcripts are on, short voice quotes to Anthropic under that account's terms (Privacy Policy, section 7). The org or the coach chooses this; Debrief sends nothing to Anthropic itself in this case. The meta brief (Privacy Policy, section 8) is researched the same way from public sources and holds no data of our users.
- Sign-in providers (Google Ireland Limited; Meta Platforms Ireland Limited for Facebook; Discord Inc.; Microsoft; whichever the site offers): you choose one to sign in. They are not our subprocessors but independent controllers of your account with them: they send us only your account id, name and email address (the privacy policy lists exactly what), and learn that you signed in to Debrief. See their privacy policies: https://policies.google.com/privacy, https://www.facebook.com/privacy/policy, https://discord.com/privacy, https://privacy.microsoft.com.
- Members' own PCs in an org's swarm process recordings for their org; they act for the org, not for Debrief (DPA, section 1.3).
- GitHub hosts Debrief's source code and runs its tests and deployments. No customer data is stored there.
- Downloads by the client and the cloud servers. When the Debrief client is installed (on your PC, or on one of our cloud servers), it downloads software and models from their publishers (for example the uv installer from astral.sh, Python packages from PyPI, PyTorch from download.pytorch.org, and the speech-recognition and speaker models from Hugging Face). These services see the computer's IP address, as with any download; the client sends them no recordings or other personal data.
Planned
No further subprocessors are planned at the moment. We will update this page and notify org admins at least 30 days before any new subprocessor of an org's recordings starts.