Sub-processors
Draft, not yet reviewed by a lawyer. This text is a working draft and may change before Aria takes payments. Placeholders in [square brackets] are still to be filled in.
Aria uses these companies to provide the service. Each processes personal data only on our instructions, under a written agreement with data protection terms. We tell customers about a new sub-processor at least [30] days before it starts, by email; you can object as described in the data processing agreement.
| Company | Where | What for | Personal data |
|---|---|---|---|
| OVH Limited (OVHcloud) | OVHcloud group; data centres in the EU [confirm the entity and the regions used] | Server hosting: Aria’s own servers and the managed servers that run your applications, databases and backups. | Everything stored on those servers: account and project data, your applications’ data. |
| one.com Group AB | Malmö, Sweden; servers in its European data centres | Server hosting: the managed servers that run your applications, databases and backups. | Everything stored on those servers: your applications’ data. |
| Stripe (Stripe Payments Europe, Ltd.) | Ireland, with transfers to the United States | Payments, subscriptions, invoices and tax. | Name, email, billing address, payment details, plan and payment history. |
| Resend (Resend, Inc.) | United States | Sending Aria’s emails (codes, security notices, billing). | Email address, name, the content of those emails. |
| GitHub (GitHub, Inc.) | United States | Reading the repositories you connect, to deploy them. Only if you connect GitHub. | Your GitHub account and installation identifiers; the code you deploy. |
| Cloudflare (Cloudflare, Inc.) | United States, global network | Turnstile, the check that tells people from bots on sign-up and password reset. [Add DNS or proxying if used.] | IP address and browser signals during the check. |
| Anthropic (Anthropic, PBC) | United States | The AI operator, only when you use it. | What the AI operator reads to answer you: logs, configuration and server state of the workspace you ask about (secret values are masked). |
Transfers outside the UK and the EEA are covered by [Standard Contractual Clauses / the EU–US Data Privacy Framework: to be confirmed per provider].
Last updated: [date of the founder-approved version].