Data Processing & Sub-processors
This page explains how APERTURESyndicate OÜ processes personal data, lists the third-party service providers ("sub-processors") we rely on to operate the platform, and describes the safeguards that apply when data is handled outside the European Union.
It is referenced by our Privacy Policy and Data Retention policies, and our legal identity is set out on the Company Registration & Imprint page.
This document is maintained in good faith and is pending review by qualified EU/Estonian legal counsel; the English version is the controlling text.
1. Purpose & Scope
This document serves two purposes:
- Transparency. It satisfies our information duties under Articles 13 and 28 of the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR") by disclosing the sub-processors that may handle personal data when you use APERTURESyndicate services.
- Data Processing terms. For business customers who use our services to process personal data on their behalf, this page — together with our Terms of Service — forms our standard data processing terms under Article 28 GDPR, including the authorised list of sub-processors below.
The platform is intended for users aged 13 and over. We do not knowingly process the personal data of anyone under 13.
2. Roles: Controller and Processor
- As controller. For our own consumer-facing services (accounts, profiles, messaging, AI tools, music, payments and related features), APERTURESyndicate OÜ determines the purposes and means of processing and therefore acts as the data controller. How we process this data is described in our Privacy Policy.
- As processor. Where a business customer uses our services to process personal data for which they are the controller, APERTURESyndicate OÜ acts as a processor on their documented instructions. In that case the standard Article 28 GDPR processor terms apply: we process only on instruction, ensure confidentiality, implement appropriate security, assist with data-subject requests, and engage sub-processors only as described in Section 7.
In both roles, the sub-processors listed in Section 3 may be engaged to deliver the service.
3. Sub-processors
The following third parties may process personal data to provide specific platform functions. Each is used only for the stated purpose; the terms that bind those acting on our behalf are described in Section 8. The "Region" column indicates where the provider is primarily established or where processing is likely to take place.
The list is not maintained by hand. It is generated from an internal registry that is checked against our source code automatically: every external service the code talks to must have an entry, and an entry whose service no longer appears in the code is flagged for removal. That is how a monitoring provider we had never actually deployed came to be listed here in earlier versions of this page — and how it was removed.
Not every provider below receives directly identifying data in every case; some process only technical or content data. Where an entry is marked (user-directed), the recipient is chosen by you, not by us — see Section 4.
| Sub-processor | Purpose | Data categories | Region | Transfer mechanism |
|---|---|---|---|---|
| AI inference providers (category) | Running our own models — ASAI Mini and ASAI Arc: chat and roleplay replies, coding help, reading images, text embeddings, and background tasks such as chat titles, memory summaries and the age check; answering questions typed into the documentation site's search; machine tagging of Resonance track audio (genre, mood, themes, short description) | Prompts, conversation context, attachments and tool-call results; for the age check, a sample of your own recent ASAI messages; the question typed into the documentation search, without an account; audio of published Resonance tracks — no listener data | US | SCCs (EU Standard Contractual Clauses) |
| Speech providers (category) | Transcribing audio you attach or link to and voice you dictate into the app; reading answers aloud when the primary voice provider is unavailable | The audio itself; the text being read aloud | US | SCCs (EU Standard Contractual Clauses) |
| Web search and URL-reading providers (category) | Looking something up live so an AI answer can be grounded, reading a page or document at a URL, retrieving YouTube transcripts, and reverse image search | The search query, URL or video identifier you supplied; a presigned link to a file or image you asked us to read or search with | US and EU | SCCs and/or adequacy decision, as applicable |
| Document parsing providers (category) | Converting an uploaded PDF or document into text so an AI feature can read it | The contents of the document you uploaded | US | SCCs (EU Standard Contractual Clauses) |
| Code execution providers (category) | Running generated or user-supplied code in an isolated cloud sandbox | Source code, files uploaded into the sandbox, and execution output | US | SCCs (EU Standard Contractual Clauses) |
| Vector memory storage (category) | Storing ASAI long-term memory — short summaries of earlier conversations — with their vector embeddings, so the assistant can recall them | The memory text, your internal account identifier, the conversation identifier and the embedding vector | EU (Germany) | Within EU/EEA — no transfer mechanism required |
| AI provider you connect with your own key (user-directed) | Roleplay scenes played by a model you connected yourself in ASAI settings, with your own API key | Prompts and scene context — the character and world cards in play, the conversation and your persona | Varies — determined by the user | Determined by the user; we are not a party to any agreement with that recipient |
| Anthropic | Claude models (Claude Sonnet, Claude Opus) that play roleplay scenes on the Prime and Max tiers and plan those scenes | Prompts and scene context — the character and world cards in play, the conversation and your persona | US | SCCs (EU Standard Contractual Clauses) |
| Apple (iTunes Search API) | Track metadata lookup when matching lyrics | The search string — track and artist name entered by the user | US | SCCs and/or adequacy decision, as applicable |
| Apple (Sign in with Apple, App Store) | Sign-in via Apple ID; confirming purchases and subscriptions made through the App Store in our iOS apps — Apple takes the payment itself, under its own terms | Apple account identifier, email address (or Apple's private relay address) and name if you share them; App Store transaction, product and subscription identifiers linked to your account | US | SCCs (EU Standard Contractual Clauses) |
| Arbitrary media hosts (yt-dlp) (user-directed) | Fetching the audio of a video you link in ASAI so it can be transcribed | Our server's IP address and the requested URL; no user personal data is transmitted | Varies — determined by the user | Determined by the user; we are not a party to any agreement with that recipient |
| Audius | The open catalogue in Resonance — our server fetches track metadata; when you play such a track, your device loads its audio and cover art straight from Audius servers | Your IP address and User-Agent when your device loads audio or cover art; no account data | Varies | SCCs and/or adequacy decision, as applicable |
| Cloudflare | CDN, edge caching, WAF and DNS in front of all public domains; the Turnstile bot check on registration and on the illegal-content report form; separately cdnjs as a public stylesheet CDN | IP address, User-Agent, request URL and TLS metadata of every visitor; browser signals collected by the Turnstile check | US / global | SCCs (EU Standard Contractual Clauses) |
| CoinGecko | Cryptocurrency market data for an AI tool | Coin identifiers only; no personal data is transmitted | Varies | SCCs and/or adequacy decision, as applicable |
| Deezer | Track metadata lookup when matching lyrics | The search string — track and artist name entered by the user | EU (France) | Within EU/EEA — no transfer mechanism required |
| Discord | Linking your Discord account to your profile (OAuth); Rich Presence in the Resonance desktop client — showing the current track on your Discord profile | On linking: Discord user identifier, username, avatar and the connected accounts you choose to show; for Rich Presence: track title and artist, cover art, playback timestamps — visible to other Discord users | US | SCCs (EU Standard Contractual Clauses) |
| GitHub | Sign-in via GitHub OAuth, reading public repositories for AI features, submitting user contributions to a repository, and loading SYNX documentation in the browser | Email and GitHub profile on sign-in; the contents of a user submission; visitor IP when documentation is loaded | US | SCCs (EU Standard Contractual Clauses) |
| GitHub (Copilot MCP) | MCP connector to the user's repositories, issues and pull requests | Prompts and tool-call arguments, the user's OAuth token, and the contents of their repositories | US | SCCs (EU Standard Contractual Clauses) |
| Google (s2 favicon service) | Displaying site icons in the source list of an AI answer | Visitor IP address and the domain shown in the sources list | US | SCCs (EU Standard Contractual Clauses) |
| Google (Sign-In) | Sign-in and registration via Google OAuth | Email, name, avatar and Google account identifier | US | SCCs (EU Standard Contractual Clauses) |
| Google Drive (MCP) | MCP connector to the user's Google Drive files | Prompts and tool-call arguments, OAuth token, and Drive file contents | US | SCCs (EU Standard Contractual Clauses) |
| Google Firebase Cloud Messaging | Delivery of push notifications to mobile applications | Device push token, platform, notification title and body | US | SCCs (EU Standard Contractual Clauses) |
| Google Play (billing) | Confirming and acknowledging purchases and subscriptions made through Google Play in our Android apps — Google takes the payment itself, under its own terms | Purchase token, order, product and subscription identifiers and subscription status, linked to your account | US | SCCs (EU Standard Contractual Clauses) |
| Hetzner | Application hosting, databases, encrypted database backups and object storage (S3) for media and uploads | All platform data — accounts, profiles, messages, uploaded files, logs | EU (Finland) | Within EU/EEA — no transfer mechanism required |
| ipapi.co | Approximate location lookup by IP when browser geolocation is unavailable | The user's IP address — disclosed implicitly by the request itself, which is made from the browser | US | SCCs (EU Standard Contractual Clauses) |
| jsDelivr | Loading a markdown-rendering JS library on SYNX portal pages | Visitor IP address and User-Agent | Global | SCCs and/or adequacy decision, as applicable |
| ListenBrainz (MetaBrainz Foundation) | Submitting what you play in Resonance to your ListenBrainz account, after you connect it | Track title, artist, album, duration and time played; the user token you provide | US | SCCs and/or adequacy decision, as applicable |
| LRCLIB | Lookup of synchronised song lyrics | The search string — track and artist name entered by the user | Varies | SCCs and/or adequacy decision, as applicable |
| Notion | MCP connector to the user's Notion pages and databases, plus the connector OAuth flow | Prompts and tool-call arguments, OAuth token, and Notion page contents | US | SCCs (EU Standard Contractual Clauses) |
| Open-Meteo | Weather data and place geocoding for an AI tool | The place name or coordinates supplied by the user | EU | Within EU/EEA — no transfer mechanism required |
| OpenAI | GPT Image — creating and editing images, including character portraits and sprites; reading answers aloud; transcribing voice you dictate when the primary speech provider is unavailable; text embeddings for ASAI long-term memory | The image prompt and any image you ask us to edit; the text being read aloud; the recording of your voice; memory summaries of your conversations and the message used to look them up | US | SCCs (EU Standard Contractual Clauses) |
| OpenStreetMap (Nominatim, map tiles) | Reverse-geocoding browser coordinates into a city and country; finding places for an AI answer; map tiles in place cards | The user's precise GPS coordinates obtained from the browser Geolocation API; the place search text; visitor IP address and User-Agent when map tiles load in the browser | UK / EU | SCCs and/or adequacy decision, as applicable |
| Resend | Transactional email delivery over SMTP — verification codes, account recovery, invitations | Recipient email address, name, and message body including one-time codes and links | US | SCCs (EU Standard Contractual Clauses) |
| SoundCloud | ASMusic catalogue integration — track links and cover art fetched through the image optimiser | Public track metadata; no user personal data is transmitted | EU (Germany) | Within EU/EEA — no transfer mechanism required |
| Stripe | Payment processing, subscriptions and webhook handling | Email, user identifier, payment and billing data | US / Ireland (EU) | SCCs and/or adequacy decision for non-EU processing |
| Telegram | Support through our Telegram bot, and the internal support group where every support request — from the website or from Telegram — is mirrored so it can be answered; publishing ASMusic releases to a channel; operational alerts about Studio actions | For support: the Telegram account identifier and name of whoever writes to the bot, the subject, text and attachments of support requests and the requester's nickname; release metadata and cover art, including artist names; alert text with the action and operator identifier | Varies | SCCs and/or adequacy decision, as applicable |
| TikTok | oEmbed link previews and retrieval of video details | The video URL supplied by the user | Varies | SCCs and/or adequacy decision, as applicable |
| Together AI | Running ASAI Mini and ASAI Arc in quiet hours, when few people are online — at regular load they run on our own servers; this covers chat and roleplay replies, reading images and background tasks such as chat titles and memory summaries | Prompts, conversation context, attachments and tool-call results | US | SCCs (EU Standard Contractual Clauses) |
| TradingView | Embedded market chart on the Lysicon Quanture landing page | IP address, User-Agent and page-view data — the widget script executes in the visitor's browser | US | SCCs (EU Standard Contractual Clauses) |
| TuneCore | Distribution of ASMusic releases to third-party stores and streaming services, and royalty reporting | Artist and rights-holder name, contact and payee details, release metadata, audio masters and cover art | US | SCCs (EU Standard Contractual Clauses) |
| unpkg | Loading the ffmpeg WASM core in the browser for media conversion in ASVentor | Visitor IP address and User-Agent | Global | SCCs and/or adequacy decision, as applicable |
| User-configured MCP servers (user-directed) | A user may connect an arbitrary third-party MCP server at a URL of their choosing | Prompts and tool-call arguments, model responses, and the bearer token the user supplies | Varies — determined by the user | Determined by the user; we are not a party to any agreement with that recipient |
| Vimeo | Embedding Vimeo videos in user content via iframe | IP address and User-Agent of the visitor viewing the page with the embed | US | SCCs (EU Standard Contractual Clauses) |
| Yahoo Finance | Stock and index quotes for an AI tool | Ticker symbols only; no personal data is transmitted | US | Not applicable — no personal data is transferred |
| YouTube (Google) | Fetching captions, oEmbed link previews and video thumbnails | The video URL or identifier supplied by the user; visitor IP when a thumbnail is loaded by the browser | US | SCCs (EU Standard Contractual Clauses) |
AI: named models, and categories for the infrastructure. ASAI combines our own models with third-party models. Our own line is ASAI Mini and ASAI Arc. Third-party models carry their maker's name in the product — Claude by Anthropic and GPT Image by OpenAI — and both companies are listed by name in the table. The infrastructure underneath our own models and AI tools — inference computing, speech, web search and URL reading, document parsing, code sandboxes and vector memory — is confidential to our business: that stack is what we build on, and publishing it hands our architecture to anyone who asks. Article 13(1)(e) of the GDPR requires us to identify "recipients or categories of recipients", and the category rows do exactly that: what leaves the platform, when, to what kind of provider, in which region, and under which transfer safeguard. Each of them processes your data on our behalf under the terms described in Section 8.
If you are a business customer or a controller whose own compliance obligations require the named list, write to [email protected] and we will provide it under confidentiality.
Further notes beyond the table:
- Music distribution. Releases you submit through ASMusic are delivered to stores and streaming services through TuneCore, our distribution partner. This happens outside the platform, under a separate agreement, so it is not visible in our code — it is listed here because it is a real recipient of artist data, not because a scanner found it.
- App store purchases. When you buy a subscription inside our iOS or Android app, Apple or Google takes the payment as the seller of record, under its own terms and privacy policy. We receive only what we need to grant the purchase to your account: the transaction, product and subscription identifiers and the subscription status.
- Public services, not processors. Some rows are public services we query for a feature — lyrics and track metadata, weather, map coordinates, link previews. They receive only what the request itself contains (a search string, a place, a URL, and the IP address of whoever makes the request) and handle it under their own terms. We list them because they are real recipients, not because they act on our instructions.
- Not every feature is used by everyone. Most AI-related entries only receive data if you actually use the feature that calls them.
- Categories change membership, not meaning. We add, replace and remove providers inside a category as the technology moves. That is not a change of recipient category and does not alter what is sent or how it is protected, so it does not trigger the notice in Section 7 — a change to the categories themselves does.
4. Recipients you choose yourself
Some features let you decide where data goes. The set of possible recipients is therefore open-ended: we cannot publish a complete list, because the list is written by you at the moment you use the feature.
MCP servers you connect. ASAI lets you attach a third-party MCP server by entering its URL and, usually, a token. Once attached, your prompts, the arguments of any tool call the model makes, and the model's responses may be sent to that server. We do not select it, we have no contract with its operator, and we cannot audit what it does with what it receives. The only limits we impose are technical: connections must use HTTPS and must resolve to a public address, so that a connector cannot be pointed at our internal network.
Videos you ask ASAI to transcribe. When you give ASAI a link to a video, our server fetches its audio from that address. The host therefore learns our server's IP address and the URL requested. No account data of yours is sent.
For both of these, the recipient is a separate controller, not our sub-processor. Their handling of the data is governed by their own terms and privacy policy, and you should read those before connecting a server or pasting a link you do not trust. Our own catalogue of pre-integrated connectors (listed individually in the table above) is different: those we selected, and they are covered by the safeguards in Sections 5 and 8.
5. International Transfers
Personal data is hosted within the European Union. Where a sub-processor in Section 3 processes data outside the EU/European Economic Area, we rely on one or more of the safeguards permitted by Chapter V of the GDPR:
- the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), supplemented by transfer risk assessments and additional technical and organisational measures where appropriate; and/or
- an adequacy decision of the European Commission, where one applies to the recipient country or framework.
For processing that takes place entirely within the EU/EEA (for example, our core hosting), no additional transfer mechanism is required. For the user-directed recipients in Section 4 we cannot provide a transfer mechanism, because we are not a party to that relationship — the choice, and its consequences, are yours.
6. Security Measures
We apply appropriate technical and organisational measures to protect personal data, proportionate to the risk, including:
- Encryption in transit for all traffic, and encryption at rest for specific high-risk secrets. What is and is not encrypted at the application layer is described precisely on our Security page.
- Access controls with authentication and authorisation, applied on a least-privilege basis so that the people who operate the platform, and its systems, access only what is necessary.
- Logical separation of data between services: each service can read only its own database schema.
- Logging and monitoring to detect and respond to security events.
- Vendor diligence before engaging a sub-processor, and contractual data-protection commitments thereafter.
We continually review and improve these measures. We do not publish low-level configuration details, as doing so would itself create a security risk.
7. Changes to Sub-processors
We may add or replace a sub-processor as the platform evolves. When we make a material change to the list in Section 3:
- We update this page and revise the "Last updated" date.
- For business customers acting as controllers, we provide reasonable advance notice of a new or replacement sub-processor before it begins processing their data.
- A controller who has a legitimate data-protection concern about a new sub-processor may object by writing to the contact in Section 9 within the notice period. We will work in good faith to address the concern; where it cannot be resolved, the controller may terminate the affected service in accordance with the Terms of Service.
8. Sub-processor Obligations
Each provider that processes personal data on our behalf is engaged under terms that include data-protection obligations — for most of them a data processing addendum that forms part of their standard terms — intended to be equivalent in substance to those we are bound by, as Article 28(4) GDPR requires. In particular, such a provider is required to:
- process personal data only for the agreed purpose and on documented instructions;
- maintain appropriate technical and organisational security measures;
- ensure that personnel handling personal data are bound by confidentiality;
- support compliance with data-subject rights and breach notification; and
- apply a valid transfer mechanism (see Section 5) for any processing outside the EU/EEA.
We remain responsible to you for the performance of our sub-processors' data-protection obligations. This does not extend to the recipients in Section 4, which you engage directly, to Apple and Google for the payments they take as sellers of record, or to the public services described in Section 3, which handle requests under their own terms.
9. Data-Subject Assistance & Contact
We assist with requests to exercise data-subject rights under the GDPR — including access, rectification, erasure, restriction, portability, and objection. Details of how these rights work and how data is kept are set out in our GDPR & Your Data page and Data Retention policy.
We operate a single official contact address. For any request or question about this document, our processing, or our sub-processors, email [email protected] (use the subject line "GDPR request" for data-subject requests).
| Purpose | Contact |
|---|---|
| All inquiries (data processing, GDPR requests, sub-processors) | [email protected] |
| Website | aperturesyndicate.com |
APERTURESyndicate OÜ is established in the Republic of Estonia (EU); this document and our processing are governed by the law of Estonia and the GDPR, with the courts of Tallinn having jurisdiction. See Company Registration & Imprint for full legal-entity details.
Version history
- v1.8 — 2026-10-14 — Together AI is now listed by name instead of inside the AI inference providers category: ASAI Mini and ASAI Arc run on our own servers at regular load and on Together AI in quiet hours, when few people are online.
- v1.7 — 2026-10-12 — Text embeddings for ASAI long-term memory moved from the AI inference providers category to OpenAI: memory summaries and the message used to look them up are now sent there to compute the vectors.
- v1.6 — 2026-10-12 — The AI inference providers category now also covers the ASAI assistant in the documentation search: the question you type there is sent to answer it from our documents; it is not tied to an account and is not used for training.
- v1.5 — 2026-10-01 — The table brought back in line with the platform as it runs today. Anthropic (Claude on the Prime and Max roleplay tiers) and OpenAI (GPT Image, reading answers aloud, dictation) are now listed by name; ASAI combines our own models with these third-party models. Image generation moved out of the AI inference category accordingly. Added: Vector memory storage as a category (ASAI long-term memory, EU), a row for a model you connect with your own key, Apple (Sign in with Apple, App Store purchases), Google Play (in-app purchases), Audius (Resonance open catalogue), ListenBrainz and Yahoo Finance (stock quotes for an AI tool, no personal data); OpenStreetMap now also covers place search and map tiles. Extended: Cloudflare (Turnstile bot check), Discord (account linking), Telegram (support bot and the support group). Hosting region corrected to Finland. Section 8 now separates providers acting on our behalf from public services and app-store sellers, which act under their own terms.
- v1.4 — 2026-09-26 — Machine tagging of Resonance track audio added to the AI inference providers category: only the audio of a published track is sent, no listener data.
- v1.3 — 2026-08-01 — AI providers are now listed by category, not by name. The vendors supplying inference, speech-to-text, retrieval, document parsing and code sandboxing are the infrastructure behind ASAI Mini and ASAI Arc, and that stack is confidential to our business. Their individual rows were replaced by five category rows stating what is sent, when, to what kind of provider, in which region and under which safeguard — the "categories of recipients" disclosure Article 13(1)(e) of the GDPR provides for. Named list available to business customers on request, under confidentiality. Everything outside the AI stack is still named individually.
- v1.2 — 2026-08-01 — Separate vision-inference route retired on 2026-07-31; requests containing images now follow the same path as every other model request, and the registry check confirms no call to that provider remains anywhere in the code. Listing a recipient we no longer send data to is as wrong as omitting one we do. Speech-to-text entries corrected to describe what they actually do — transcription only.
- v1.1 — 2026-07-31 — Sub-processor table regenerated from the machine-checked registry: Sentry removed (never deployed), TuneCore added, and a new section added for recipients you choose yourself.
- v1.0 — 2026-06-22 — Initial publication.