Subprocessors
DRAFT — pending review by qualified Spanish/EU counsel. Bracketed [PLACEHOLDERS] must be completed before this document is relied upon in production. The English version governs; other languages are provided for convenience only.
Effective date: [EFFECTIVE DATE] Last updated: [EFFECTIVE DATE]
Table of contents
- What this page is
- Who we are
- How to read the table
- Our subprocessors
- A special note about your voice
- International transfers
- Changes to this list
- Contact
1. What this page is
To run SleepyCuddle, we rely on a small number of carefully chosen third-party companies that process personal data on our behalf and under our instructions. Under the EU General Data Protection Regulation (GDPR), these companies are called subprocessors. To protect our supply-chain confidentiality, we disclose them below by category of recipient, as permitted under Articles 13–14 GDPR.
This page lists every category of subprocessor we use, exactly what each one does, which categories of personal data it handles, where the processing takes place, and how any transfer of data outside the EU/EEA is protected. It is provided in the interest of full transparency, so that you always know who touches your data and why.
Every subprocessor listed below is bound by a written data-processing agreement (DPA) consistent with the requirements of Article 28 GDPR. Those agreements require each subprocessor to process personal data only on our documented instructions, to keep it confidential, to apply appropriate technical and organisational security measures, and to assist us in meeting our obligations to you.
This list is current as of [EFFECTIVE DATE].
2. Who we are
The data controller for SleepyCuddle is:
- Operator: [OPERATOR FULL NAME] (a self-employed individual — autónomo — trading as "SleepyCuddle")
- NIF: [NIF]
- Address: Av. de les Corts Valencianes 26, 46015 Valencia, Spain
- E-mail: [CONTACT EMAIL]
- Website: sleepycuddle.com
Our lead supervisory authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.
3. How to read the table
- Category — the category of recipient that processes data on our behalf.
- Role / processing activity — what they do for us.
- Personal-data categories — the kinds of personal data they may process. They only ever receive what is necessary for their specific role.
- Processing location — the country or region where processing mainly takes place.
- Transfer safeguard — where data is processed outside the EU/EEA, the legal mechanism that protects it (see section 6).
Abbreviations: SCCs = the European Commission's Standard Contractual Clauses; DPF = the EU–US Data Privacy Framework; TTS = text-to-speech; LLM = large language model.
4. Our subprocessors
| Category | Role / processing activity | Personal-data categories | Processing location | Transfer safeguard |
|---|---|---|---|---|
| Voice-synthesis (text-to-speech) providers | Voice cloning and text-to-speech: creates the voice clone from the parent's recording and turns approved story text into audio narrated in that voice | Parent voice recording, derived voiceprint / voice clone (biometric data), story text | United States | EU Standard Contractual Clauses (SCCs) |
| AI language-model providers | LLM routing for story generation: passes personalisation inputs and prompts to language models and returns the generated story text | Child personalisation inputs (first name, approximate age, preferences) and generation prompts, resulting story text | United States | EU Standard Contractual Clauses (SCCs) |
| Payment processing | Payment processing and tax calculation via our third-party payment processor | Billing identifiers, e-mail address, payment status (we never store full card numbers) | EU / United States | EU Standard Contractual Clauses (SCCs) / EU–US Data Privacy Framework (DPF) |
| Cloud storage & content delivery (CDN) | Audio file storage and CDN delivery of generated narration | Generated audio files | Global edge network | EU Standard Contractual Clauses (SCCs) |
| Cloud hosting | Application hosting: runs the SleepyCuddle service and stores application data at rest | All application data at rest (account, family, child-personalisation, story and related data) | EU region (Frankfurt, Germany) | Data stored in the EU (Frankfurt). Where the provider's corporate group includes entities outside the EU/EEA (e.g. for administration or support), EU Standard Contractual Clauses (SCCs) apply |
| Authentication (social sign-in) | Authentication when a parent chooses to sign in with a third-party authentication provider | E-mail address and authentication identifier | EU / United States | EU Standard Contractual Clauses (SCCs) |
| Push notifications | Push-notification delivery to mobile devices via the mobile platform's push-notification service | Device push token | [PLACEHOLDER — confirm provider transfer location/mechanism] | [PLACEHOLDER — confirm provider transfer location/mechanism] |
Where a transfer location or safeguard is shown as a placeholder above, any transfer of data outside the EU/EEA is nonetheless made only under appropriate safeguards recognised under Chapter V of the GDPR; the specific mechanism will be confirmed and stated here.
5. A special note about your voice
Your voice recording and the voice clone (voiceprint) derived from it are biometric data under Article 9 GDPR, processed to deliver stories narrated in your own voice. We know how sensitive this is, so we treat it with particular care:
- We process this biometric data only on the basis of your separate, explicit consent (Article 9(2)(a) GDPR), which you give apart from our general Terms and can withdraw at any time.
- Your voice recording and voice clone are shared only with the text-to-speech / voice-clone subprocessors strictly necessary to produce the narration — namely the third-party voice-synthesis (text-to-speech) providers. No other subprocessor receives your biometric voice data.
- You can delete your recording and voice clone — by deleting your account, or on request at [CONTACT EMAIL]. When you do, it is deleted from our systems, and we also request deletion by the relevant providers in line with our data-processing agreements.
6. International transfers
SleepyCuddle serves the EU/EEA, and our application hosting takes place in the EU (Frankfurt, Germany). Some of our subprocessors are located in, or may process data from, the United States or other countries outside the EU/EEA.
Wherever personal data leaves the EU/EEA, we protect it using appropriate safeguards recognised under Chapter V of the GDPR:
- the European Commission's Standard Contractual Clauses (SCCs), and/or
- certification under the EU–US Data Privacy Framework (DPF) where the provider participates,
together with, where appropriate, additional technical and organisational measures. The specific safeguard for each category is shown in the table above; where a cell is marked as a placeholder, we will confirm and publish the precise mechanism before relying on this document. You may request a copy of the relevant transfer mechanism by contacting us at [CONTACT EMAIL].
7. Changes to this list
We may add, replace, or remove subprocessors as our service evolves. If we make a material change to this list — for example, adding a new subprocessor or changing what an existing one does with your data — we will give you notice in advance or without undue delay, through the app, by e-mail, or by updating this page with a new "Last updated" date. This gives you the opportunity to review the change and, where you disagree, to exercise your rights, including withdrawing consent or closing your account.
8. Contact
If you have any questions about our subprocessors or how your data is handled, please contact:
- [OPERATOR FULL NAME] — NIF [NIF]
- Av. de les Corts Valencianes 26, 46015 Valencia, Spain
- E-mail: [CONTACT EMAIL]
You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.