This is an English translation of the Slovenian original, provided for convenience. In case of any discrepancy, the Slovenian version prevails.
VITASIS, informacijske tehnologije, d.o.o., Partizanska cesta 8A, 1381 Rakek (“Vitasis”), engages the sub-processors listed below in providing the Truebar™ service. This list is Annex 3 to the Data Processing Agreement (DPA) and forms an integral part of that agreement as amended from time to time.
Notification of changes. We notify customers by e-mail at least 14 days in advance of any intended addition or replacement of a sub-processor. Within that period, the customer may object to the change on reasonable data protection grounds, as set out in Article 6 of the DPA.
We have concluded a data processing agreement with each sub-processor that imposes on it the same data protection obligations as those we have under the DPA. No sub-processor uses customer content to train artificial intelligence models.
1. Sub-processors for customer content
These sub-processors process the content that customers upload to or create in the service (recordings, transcripts, translations, summaries).
| Sub-processor | Purpose | Plans | Processing location | Transfer mechanism |
|---|---|---|---|---|
| SRC d.o.o., Tržaška cesta 116, Ljubljana, Slovenia | Service hosting and content storage | All | Slovenia | Not required (EEA) |
| Soniox, Inc., USA | Speech recognition and translation | Speech recognition: OSNOVNI, ZAČETNI, PRO; Enterprise only at the customer’s choice. Translation: all | EU; processing without persistent storage (deleted immediately after the result is retrieved); system data may also be processed outside the EU | EU Standard Contractual Clauses |
| OpenAI Ireland Ltd. | AI summarisation | All plans with the summarisation feature | EEA (European data residency region) | EU-U.S. Data Privacy Framework / EU Standard Contractual Clauses |
Vitasis proprietary models
In the Enterprise plan, speech recognition is performed by default using proprietary Truebar models deployed in Vitasis’s environment in a data centre in Slovenia. In this case, audio for transcription is not transferred to any third party. The proprietary models are not a sub-processor; we list them for transparency. An Enterprise plan customer may also choose Soniox as the speech recognition provider.
2. Other providers
The following providers do not process customer content, but rather data for which Vitasis is the controller (account data, payments, e-mails to users, website visits). We list them for completeness; their processing is described in the Privacy Policy.
| Provider | Purpose | Processing location | Transfer mechanism |
|---|---|---|---|
| Kontim d.o.o., Slovenia | Accounting | Slovenia | Not required (EEA) |
| Plus Five Five, Inc. (Resend), San Francisco, USA | Sending system notifications and trial-period guides and tips | USA (sending via the EU region) | EU-U.S. Data Privacy Framework and EU Standard Contractual Clauses |
| Stripe Payments Europe, Ltd., Ireland | Processing of subscription card payments | EU and USA (systematic transfer to Stripe, LLC) | EU Standard Contractual Clauses (Stripe’s Data Transfers Addendum) and the EU-U.S. Data Privacy Framework |
| Google Ireland Ltd. (Google Analytics, Google Tag Manager) | Website visit analytics, only with consent | EU and USA | EU-U.S. Data Privacy Framework |
| Meta Platforms Ireland Ltd. (Meta Pixel) | Ad performance measurement and targeting, only with consent | EU and USA | EU-U.S. Data Privacy Framework; joint controllers with Vitasis for data collection |
Stripe acts as an independent controller for selecting banks and payment method providers, fraud prevention, managing financial and security risks, customer verification and anti-money laundering, and for developing its own services. This processing is governed by Stripe’s privacy policy, available at stripe.com/privacy.