Subprocessors

ValueRoom ApS · CVR 46900790 · Njalsgade 21F, 2., DK-2300 Copenhagen S. Last updated 12 November 2026.

The application, the database and uploaded files run in Frankfurt, Germany. The providers below process data for us; some of them are in the United States, and each transfer rests on the mechanism named beside it. This is the same list as section 7 of the privacy notice, drawn from one source.

Vercel Inc.
Hosting and compute for the application; server request logs; cookieless visitor counts on this public site
Where: Frankfurt, Germany (EU)
Transfer basis: Operations and support may reach the US. EU-U.S. Data Privacy Framework and standard contractual clauses
Vercel Blob (Vercel Inc.)
File storage: uploaded documents, logos, content blocks, meeting recordings
Where: Frankfurt, Germany (EU)
Transfer basis: As above
Neon Inc.
The database: all application data at rest, encrypted
Where: Frankfurt, Germany (EU)
Transfer basis: Operations and support may reach the US. EU-U.S. Data Privacy Framework and standard contractual clauses
Anthropic PBC
AI inference for every AI feature, through one audited code path. Receives the prompt a feature needs; never used to train models; deleted by Anthropic within 30 days
Where: United States
Transfer basis: Standard contractual clauses (in Anthropic's data processing addendum)
Resend Inc.
Transactional email: room links, invites, follow-ups, approval links. Delivery logs kept 30 days
Where: United States
Transfer basis: EU-U.S. Data Privacy Framework and standard contractual clauses
Functional Software Inc. (Sentry)
Server-side error diagnostics when something breaks: the stack trace, the route, an identifier for grouping. No page content, no IP address, no request body. Events kept 30 days
Where: Frankfurt, Germany (EU)
Transfer basis: Operations and support may reach the US. EU-U.S. Data Privacy Framework and standard contractual clauses
HubSpot Inc.
Our own CRM: the record of a lead from this site (name, work email, company, how the evaluation is going). Also the CRM a customer may connect to its own tenant
Where: Our account: HubSpot's EU data centre. A customer's own account: its own data centre
Transfer basis: EU-U.S. Data Privacy Framework and standard contractual clauses
Slack Technologies
One short internal notification to our team when an evaluation room is requested or reaches a new stage (name, company)
Where: United States
Transfer basis: Standard contractual clauses; EU-U.S. Data Privacy Framework through Salesforce
AssemblyAI Inc., when a customer uses meeting transcription
Speech-to-text of a recorded meeting, on AssemblyAI's EU endpoint: never used to train their models; audio deleted within 48 hours, transcripts within 30 days
Where: European Union (account and usage records in the US)
Transfer basis: EU-U.S. Data Privacy Framework and standard contractual clauses
Daily.co, when a customer uses hosted meetings
Live meeting audio and video; cloud recordings until we pull them
Where: United States
Transfer basis: EU-U.S. Data Privacy Framework
WorkOS Inc., when a customer uses enterprise single sign-on
Sign-in assertions and directory sync for that customer's users
Where: United States
Transfer basis: Standard contractual clauses
Upstash Inc., when enabled
Rate-limit counters keyed by a scrambled form of the email or IP address that cannot be read back; no readable identifier leaves the application
Where: EU region when enabled
Transfer basis: EU-U.S. Data Privacy Framework and standard contractual clauses
FullEnrich Corp, when we write to you first
Finds the work email address of a named person at a named company for our own outreach. Results are deleted from its systems after three months
Where: United States company; storage in the EU
Transfer basis: Standard contractual clauses (in FullEnrich's data processing agreement)
521 Products Pty Ltd (Smartlead), when we write to you first
Sends our outreach email from our own mailboxes and shows us replies: name, work email, company, the message and any reply
Where: Amazon Web Services, outside the EU (Australia and the United States, by its own documents)
Transfer basis: Standard contractual clauses and the UK addendum (in Smartlead's data processing addendum)
Microsoft Ireland Operations Ltd, when we write to you first
Hosts the mailboxes our outreach email is sent from and replies arrive in
Where: European Union
Transfer basis: Within the EU. Microsoft's support may reach other countries under standard contractual clauses
Cloudflare Inc.
Domain name resolution for valueroom.app (DNS only; no page content, no form data)
Where: Global network
Transfer basis: EU-U.S. Data Privacy Framework and standard contractual clauses

Provider	What it does for us	Where	Transfer basis
Vercel Inc.	Hosting and compute for the application; server request logs; cookieless visitor counts on this public site	Frankfurt, Germany (EU)	Operations and support may reach the US. EU-U.S. Data Privacy Framework and standard contractual clauses
Vercel Blob (Vercel Inc.)	File storage: uploaded documents, logos, content blocks, meeting recordings	Frankfurt, Germany (EU)	As above
Neon Inc.	The database: all application data at rest, encrypted	Frankfurt, Germany (EU)	Operations and support may reach the US. EU-U.S. Data Privacy Framework and standard contractual clauses
Anthropic PBC	AI inference for every AI feature, through one audited code path. Receives the prompt a feature needs; never used to train models; deleted by Anthropic within 30 days	United States	Standard contractual clauses (in Anthropic's data processing addendum)
Resend Inc.	Transactional email: room links, invites, follow-ups, approval links. Delivery logs kept 30 days	United States	EU-U.S. Data Privacy Framework and standard contractual clauses
Functional Software Inc. (Sentry)	Server-side error diagnostics when something breaks: the stack trace, the route, an identifier for grouping. No page content, no IP address, no request body. Events kept 30 days	Frankfurt, Germany (EU)	Operations and support may reach the US. EU-U.S. Data Privacy Framework and standard contractual clauses
HubSpot Inc.	Our own CRM: the record of a lead from this site (name, work email, company, how the evaluation is going). Also the CRM a customer may connect to its own tenant	Our account: HubSpot's EU data centre. A customer's own account: its own data centre	EU-U.S. Data Privacy Framework and standard contractual clauses
Slack Technologies	One short internal notification to our team when an evaluation room is requested or reaches a new stage (name, company)	United States	Standard contractual clauses; EU-U.S. Data Privacy Framework through Salesforce
AssemblyAI Inc., when a customer uses meeting transcription	Speech-to-text of a recorded meeting, on AssemblyAI's EU endpoint: never used to train their models; audio deleted within 48 hours, transcripts within 30 days	European Union (account and usage records in the US)	EU-U.S. Data Privacy Framework and standard contractual clauses
Daily.co, when a customer uses hosted meetings	Live meeting audio and video; cloud recordings until we pull them	United States	EU-U.S. Data Privacy Framework
WorkOS Inc., when a customer uses enterprise single sign-on	Sign-in assertions and directory sync for that customer's users	United States	Standard contractual clauses
Upstash Inc., when enabled	Rate-limit counters keyed by a scrambled form of the email or IP address that cannot be read back; no readable identifier leaves the application	EU region when enabled	EU-U.S. Data Privacy Framework and standard contractual clauses
FullEnrich Corp, when we write to you first	Finds the work email address of a named person at a named company for our own outreach. Results are deleted from its systems after three months	United States company; storage in the EU	Standard contractual clauses (in FullEnrich's data processing agreement)
521 Products Pty Ltd (Smartlead), when we write to you first	Sends our outreach email from our own mailboxes and shows us replies: name, work email, company, the message and any reply	Amazon Web Services, outside the EU (Australia and the United States, by its own documents)	Standard contractual clauses and the UK addendum (in Smartlead's data processing addendum)
Microsoft Ireland Operations Ltd, when we write to you first	Hosts the mailboxes our outreach email is sent from and replies arrive in	European Union	Within the EU. Microsoft's support may reach other countries under standard contractual clauses
Cloudflare Inc.	Domain name resolution for valueroom.app (DNS only; no page content, no form data)	Global network	EU-U.S. Data Privacy Framework and standard contractual clauses

Systems a customer connects to its own tenant (a CRM, a support desk, an issue tracker, a meeting-notes tool, the customer's own AI assistant) are that customer's own vendors, connected on its instruction, and are not on this list.

Questions about a provider go to hello@valueroom.app.