Sub-processors
Draft, subject to legal review. Last updated 2026-08-03.
These are the third parties that process personal data on RoomRadar’s behalf to deliver the platform. Max Lindholm AB (org. nr. 559407-9633), trading as RoomRadar, acts as the data processor for customer meeting content. Each sub-processor is bound by a data processing agreement and may process data only on our documented instructions.
Current sub-processors
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| OpenRouter, Inc.Secure Mode routes both text generation and the budget speech-to-text tier through OpenRouter's EU in-region endpoint (eu.openrouter.ai) with zero data retention. | API gateway for AI model calls: transcript summaries, chat, workshop analysis, image generation, and speech-to-text. OpenRouter is contractually responsible for its downstream model providers under GDPR Art. 28(4). | United States | Standard Contractual Clauses |
| Soniox, Inc.Transcription runs in Soniox's EU region (Frankfurt); zero data retention is their default across all regions. The US entity remains the contracting party, hence the SCCs. | Real-time speech-to-text transcription (default quality tier). | United States | Standard Contractual Clauses |
| Cantab Research Ltd (Speechmatics)Processing runs on Speechmatics' EU realtime endpoint, but the contracting entity is UK-established. | Speech-to-text transcription for the speaker-data quality tier, on an EU-hosted realtime endpoint. | United Kingdom | UK adequacy decision |
| Clerk, Inc. | Authentication and user identity (login, sessions). | United States | EU-US Data Privacy Framework |
| Stripe Payments Europe, Ltd. | Payment and subscription processing. Card details are sent directly to Stripe and are not stored on RoomRadar systems. | Ireland (EU) | EU entity |
| Skribe VOF (Skribby)Used only for remote / distance-meeting groups. | Meeting bot that joins remote video calls (Google Meet, Zoom, Microsoft Teams) to capture group audio. | Belgium (EU) | EU entity |
| Google LLCLoaded only after you accept analytics cookies. | Website analytics. | United States | Standard Contractual Clauses |
| ResendHandles account and contact-form email. | Transactional and contact-form email delivery. | United States | Standard Contractual Clauses |
AI model providers
All AI features, transcript summaries, chat, workshop analysis, image generation, and Whisper transcription, are routed through OpenRouter. OpenRouter acts as our sub-processor and is contractually responsible under GDPR Art. 28(4) for the downstream model providers it routes to. Those model providers currently include:
This list is generated from our live model configuration and updates automatically as models change. These individual model providers are OpenRouter’s sub-processors, not direct RoomRadar sub-processors.
Secure Mode / EU tier
Secure Mode confines AI processing to the EU. It is not currently enabled. When offered (Enterprise and Weekly Pass plans), it would rely on:
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| OpenRouter, Inc. (EU region) | AI model routing confined to the EU region with zero data retention, for Secure Mode. | European Union | EU region routing |
| Scaleway SAS | EU compute and object storage (Secure Mode / EU tier). | France (EU) | EU entity |
| Nebius B.V. | EU AI model inference (Secure Mode / EU tier). | Netherlands (EU) | EU entity (account region set to EU) |
Self-hosted infrastructure
The following runs on RoomRadar-operated infrastructure and is not a third-party sub-processor, listed here for transparency:
- LiveKit (self-hosted) — Real-time transport of participant audio during live sessions.
Changes to this list
We give customers at least 14 days’ advance notice before adding a new sub-processor, so you have the opportunity to object. To receive change notifications, contact us at lindholm.maximilian@gmail.com.