Sub-Processors | SpaceMD

Waybound AS, operating SpaceMD, engages the third-party Sub-Processors listed below to deliver the SpaceMD service. Each Sub-Processor is contractually bound by data-protection obligations substantially equivalent to those in our Data Processing Agreement (GDPR Art. 28(4)).

1. Current Sub-Processors

Sub-Processor	Purpose	Location	Their DPA
Supabase Inc.	Application hosting, authentication, Postgres database, edge functions, object storage	United States and EU regions	View
Cloudflare, Inc.	Edge delivery (CDN), DDoS protection, bot management	Global	View
Stripe, Inc.	Subscription billing, invoicing, customer portal, fraud prevention	United States (DPF certified)	View
PostHog Inc.	Product analytics, session identifiers, error tracking	United States or European Union (depending on configuration)	View
Google LLC	Google Analytics 4 on the public marketing website; Gemini / Vertex AI for first-party AI features	United States (DPF certified)	View
OpenAI, L.L.C.	First-party AI features (GPT family models, accessed via API)	United States (DPF certified for OpenAI Ireland Ltd transfers)	View
Anthropic PBC	First-party AI features (Claude family models, accessed via API)	United States	View

2. Change Notifications

We will give at least 30 days' notice before adding or replacing a Sub-Processor by updating this page and, for paying customers and customers under a signed DPA, by email. Customers may object on reasonable data-protection grounds as set out in our DPA §4. To receive change notifications, email legal@spacemd.ai with the subject "Sub-processor updates."

3. User-Supplied (BYOK) AI Providers

If you connect your own AI provider via Account > AI providers (BYOK), that provider is not a SpaceMD Sub-Processor. Your relationship is with that provider directly under its own terms. See our AI Transparency Policy §4.

4. Contact

For questions about Sub-Processors, contact us at:
Waybound AS
Organization number: 937 496 184
0763 Oslo, Norway
Email: legal@spacemd.ai