Matti Venghaus is the controller for Sort My Thoughts. The providers below process personal data on the controller's behalf under Art. 28 GDPR (Auftragsverarbeitung). This page lists what each one does, which data it can see, where processing takes place and the state of the data processing agreement (DPA / AVV).
Draft agreements are kept in the repository under docs/dpa/ They are drafts written from what the application technically does, not legal advice, and each provider's own Art. 28 terms take precedence where they exist.
Hosts the web application and proxies AI requests to the model provider.
Data: Request metadata (IP address, user agent, request id); Text and audio submitted for AI processing.
Location: To be confirmed by the operator with the provider.
Transfers: EU Standard Contractual Clauses where processing takes place outside the EU/EEA — to be confirmed in writing.
Agreement: Agreement not yet confirmed in writing by the operator. Draft on file: docs/dpa/lovable-avv.md.
Stores accounts, to-dos, ideas, raw inputs and subscription status; handles sign-in.
Data: Email address, account id, authentication metadata; Thought content: raw inputs, to-dos, ideas; Plan and subscription status.
Location: To be confirmed by the operator (database region is chosen at project creation).
Transfers: EU Standard Contractual Clauses where a non-EU region or non-EU support access applies.
Agreement: Agreement not yet confirmed in writing by the operator. Draft on file: docs/dpa/supabase-avv.md.
Structures submitted text into to-dos and ideas.
Data: The text of a single thought, plus the organizing instruction — no account id, email or IP.
Location: Determined by the model provider; not selected by this application.
Transfers: EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework — to be confirmed.
Agreement: Agreement not yet confirmed in writing by the operator. Draft on file: docs/dpa/google-gemini-avv.md.
Transcribes voice notes into text. Audio is held in memory only and never stored by this application.
Data: Recorded audio of a single voice note and its transcript.
Location: Determined by the model provider; not selected by this application.
Transfers: EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework — to be confirmed.
Agreement: Agreement not yet confirmed in writing by the operator. Draft on file: docs/dpa/openai-transcription-avv.md.
Takes payments and manages subscriptions. Card data never reaches our servers.
Data: Email address, account id passed as customer reference; Payment and invoice data held by Stripe.
Location: Stripe processes payment data internationally.
Transfers: Stripe's published data processing terms and EU Standard Contractual Clauses.
Agreement: Provider publishes data processing terms — accept and keep a copy — provider terms. Draft on file: docs/dpa/stripe-avv.md.
If a provider is added or replaced, this page is updated before the change takes effect where that is possible, and otherwise without undue delay. Questions: smt.sortmy@gmail.com.