In short: The recordings are kept with Cloudflare in the EU. Transcripts, summaries, notes and the rest of the content in the cloud are kept in the database with Railway in Amsterdam. Transcription is done by Gladia in France, and the summaries by Microsoft in Sweden. Several of the companies are American, and some of it may be processed in the USA. This is set out for each company below. In local mode on Mac, Windows, iPhone and Android, none of them are used for transcription or AI.

The subprocessors for the content in Sayable

These process recordings, transcripts, summaries, notes and the accounts in Sayable, including for Team.

Railway Corporation · USA

Role	Runs Sayable's server and database.
Data	All the content in the cloud except the recordings themselves: transcripts, summaries, notes, tasks, titles and settings, and the accounts (email address, team and usage). The server's operational logs, which may contain account IDs, email addresses and IP addresses.
Where	The server and the database: Amsterdam, the Netherlands (EU). The operational logs: USA. Railway states that the company's main operations are in the USA.
Basis for transfer	EU–US Data Privacy Framework, and the EU standard contractual clauses in Railway's data processing agreement, which A-JOB has signed.

Cloudflare, Inc. (R2) · USA

Role	Stores the recordings.
Data	Audio and video from the meetings you store in the cloud.
Where	EU.
Basis for transfer	Stored in the EU. EU–US Data Privacy Framework and the EU standard contractual clauses in Cloudflare's data processing agreement.

Cloudflare, Inc. (DNS and proxy) · USA

Role	All traffic to sayable.no, app.sayable.no, api.sayable.no and dl.sayable.no goes through Cloudflare, which forwards it to the server.
Data	Everything sent between you and the service, including the content, and your IP address.
Where	The Cloudflare data centre nearest to you. It may be outside the EU/EEA.
Basis for transfer	EU–US Data Privacy Framework and the EU standard contractual clauses in Cloudflare's data processing agreement.

Gladia SAS · France

Role	Transcribes audio in the cloud, provides live text and tells the speakers apart. We ask Gladia to delete the audio and the text once the text has been stored with us.
Data	The audio from meetings and dictation, and the text that comes back.
Where	Live text: EU. Whole files: we do not choose a region when the file is sent, and Gladia's data processing agreement allows processing in Europe and the USA. Gladia itself uses Amazon Web Services (USA), Modal Labs (EU and USA) and Gladia Inc. (USA).
Basis for transfer	For processing outside the EU/EEA: the EU standard contractual clauses or the EU–US Data Privacy Framework, as Gladia's data processing agreement states.

Microsoft (Azure OpenAI) · USA

Role	Text AI in the cloud: summaries, chat, insights, tasks and tidying up dictation.
Data	The transcript, the notes and the questions sent to the language model, and the answer.
Where	Sweden, and otherwise within the EU. Microsoft may store, in Sweden, content that its abuse monitoring has flagged, and let authorised employees in the EEA read it.
Basis for transfer	Processed in the EU. EU–US Data Privacy Framework and the EU standard contractual clauses in Microsoft's data processing agreement.

Plus Five Five, Inc. (Resend) · USA

Role	Sends email from Sayable: sign-in, team invitations and messages about the account.
Data	The email address and the content of the email, for example a sign-in link, the team's name and who sent the invitation.
Where	Sent from Ireland (EU). Resend states that its main processing takes place in the USA.
Basis for transfer	EU–US Data Privacy Framework and the EU standard contractual clauses.

Apple Inc. (Apple Push Notification service) · USA

Role	Delivers notifications to the iPhone app.
Data	A notification key for the phone, and the text of the notification: that a summary is ready, or the name of the Mac that is recording. The meeting title only if you have turned on “Show meeting title in notifications” yourself.
Where	USA. If a notification cannot be delivered at once, Apple may hold the latest one for up to 30 days.
Basis for transfer	The transfer rests on Apple's own terms: Apple Inc. is not in the EU–US Data Privacy Framework, and Apple's developer terms (Apple Developer Program License Agreement), which govern the notification service, contain neither a data processing agreement nor the EU standard contractual clauses. Apple states that its own transfers from the EEA are based on standard contractual clauses. We do not have a separate transfer agreement with Apple, and therefore send as little as possible in the notifications.

Microsoft (Microsoft 365) · USA

Role	Email to hei@sayable.no, and the calendar and the Teams meeting when you book a walkthrough with us.
Data	What you write to us, with attachments, and your name and email address.
Where	EU/EEA.
Basis for transfer	Processed in the EU/EEA. EU–US Data Privacy Framework and the EU standard contractual clauses in Microsoft's data processing agreement.

Other services we use

These are used for payment and for the website. They do not process recordings, transcripts or summaries. More about each of them is in the privacy policy.

Stripe · USA	Payment and subscriptions on the web. We never receive the card number.
Google Cloud (Pub/Sub) · USA	Delivers the notifications about purchases in Google Play from Google to the server.
Apple (App Store) and Google (Google Play) · USA	Purchases in the apps, under Apple's and Google's own terms.
Google Analytics, Google Ads and Meta · USA and Ireland	Statistics and ad measurement on sayable.no, only if you have said yes to it.

These are not subprocessors

Hugging Face and GitHub: the models that run on the device are downloaded from there. That is a software download, and neither audio, text nor account information is sent there.
OpenAI, xAI and Gladia when you use your own API keys: that is your own agreement with the provider, and the audio or the text goes straight there without going through us. Your own keys require a personal Sayable Local licence.

Local mode

In local mode on Mac, Windows, iPhone and Android, audio, transcripts and summaries stay on the device, and none of the companies above are used for transcription or AI. If you are signed in, some things still go to your account, for example the dictionary, summary templates and notes when syncing is on. These are then kept with Railway like other content in the cloud. The privacy policy describes everything that goes to the account.

Changes

This page is updated when we start or stop using a subprocessor, and the date at the top shows when it was last changed. Team customers are notified by email at least 30 days before a new subprocessor is engaged, as the data processing agreement states.

See also the privacy policy and how we secure the service. Send questions to hei@sayable.no.

Who processes the data