Back to home
TRANSPARENCY

Sub-processors

LAST UPDATED 2026-04-24
Subscribe to changes

A sub-processor is a third-party company that processes your data on Lanreal's behalf so Whisperstream can work. This page lists the current sub-processors and records every change over time. The Privacy Policy, Section 5, remains the authoritative source.

ADVANCE NOTICE

Lanreal gives at least 30 days of advance notice before any sub-processor change takes effect. Notice is posted on this page and in the RSS feed.

Current sub-processors

Polar Software Inc.Delaware, USA

license activation and Merchant of Record.

TRANSFER
Polar's Data Processing Addendum (at `https://polar.sh/legal/data-processing-addendum`), which forms part of the Polar Master Services Terms, designates Polar as the processor and incorporates the European Commission's Standard Contractual Clauses (Controller-to-Processor, Module 2) and the UK International Data Transfer Addendum as the mechanisms for transfers of personal information from the European Economic Area and the United Kingdom to the United States.
LINKS
Privacy policyData processing agreement
Hugging Face, Inc.Delaware, USA

model distribution.

TRANSFER
Hugging Face's processing is governed by Hugging Face's privacy policy at `https://huggingface.co/privacy` and its Data Processing Agreement, which incorporates the European Commission's Standard Contractual Clauses (Controller-to-Processor, Module 2) for transfers of personal information from the European Economic Area to the United States.
LINKS
Privacy policy
Cloudflare, Inc.Delaware, USA

fallback model distribution mirror.

TRANSFER
Cloudflare's GDPR transfer mechanism is the European Commission's Standard Contractual Clauses combined with EU-U.S.
LINKS
Privacy policy
Supabase, Inc.Delaware, USA

reviews and feedback database.

TRANSFER
Lanreal has executed Supabase's Data Processing Addendum (published at `https://supabase.com/legal/dpa`); the Standard Contractual Clauses (Controller-to-Processor, Module 2) incorporated into that Addendum are the transfer mechanism for personal information sent from the European Economic Area, the United Kingdom, and Switzerland to Supabase in the United States.
LINKS
Privacy policyData processing agreement

How to object

If you do not accept a sub-processor change, you can delete your account at any time. Other data rights, including correction, portability, and objection, are listed in Privacy Policy Section 10.

Privacy Policy, Section 10

2026-04-24Initial publication
Effective: immediately

Whisperstream publishes its sub-processor list for the first time. Four sub-processors process user data as of this date: Polar Software Inc. (license activation and Merchant of Record), Hugging Face, Inc. (one-time model download on first run), Cloudflare, Inc. (website CDN and model-download fallback), and Supabase, Inc. (reviews and feedback database). This entry is a baseline, not a change. See Privacy Policy, Section 5, for data categories, jurisdictions, and transfer mechanisms.

Full Privacy Policy

This page is a summary. For the complete statement, including data categories, lawful bases, transfer mechanisms, and your rights, see the Privacy Policy.

Section 5, Sub-processorsSection 14, Changes to this Policy