Sub-processors.
Draft 1. Last updated: .
A sub-processor is another company that handles personal data for RepSidecar. RepSidecar is run by Ryan Stempski, a sole proprietor in Florida. This list goes with the Privacy page, the Retention table and the Terms of Service. We will update this list before we add a sub-processor, and show the date at the top.
In use today
Swipe the table to see all 5 columns.
| Sub-processor | Purpose | Data | Region | Their terms |
|---|---|---|---|---|
| Vercel Inc. | Hosts repsidecar.com. Runs the /api/submit function, which checks form fields and forwards them to Google. | IP address and request details (for example path, headers and user agent) for every page view. The waitlist and contact form fields pass through the function in memory. The function code writes no log lines and keeps no copy of an entry. Vercel keeps runtime logs of requests; see the Retention table. | Function: Washington, D.C., USA (iad1). Static pages: served from Vercel’s network; the locations are unknown. | Vercel DPA. Vercel privacy notice. |
| Google (consumer account): Sheets, Apps Script and the founder’s Gmail Draft: not final | A Google Apps Script web app receives entries from /api/submit and writes them to a private Google Sheet controlled by the founder. The founder’s Gmail, on the same consumer account, sends waitlist members one short question by email and holds their replies. | Waitlist: email, role, sales calls per month, country, “where did you hear about us”, first_touch, page, kind, submitted_at, and a time stamp added on arrival. Contact: email, message, page, kind and the time stamp. Email: your email address and your reply. | Unknown. | The Sheet, the web app and the mailbox are in a personal (consumer) Google account, not Google Workspace: Google Privacy Policy and Google Terms of Service. Also see the Apps Script web apps guide. |
Planned (not in use yet)
We plan to take payments through our payment processor (named here before the first payment) and to use Anthropic as the AI provider. Neither is in use yet.
Swipe the table to see all 5 columns.
| Sub-processor | Purpose | Data | Region | Their terms |
|---|---|---|---|---|
| Our payment processor Draft: not final | Takes payments for the $29 founding reservation and for Pro subscriptions. Planned. The account is not yet active. | Name, email, card details, billing address, IP address, payment and refund records. RepSidecar does not see or store full card numbers. Its data processing terms say it acts as a processor for some data and as a controller for other data. | Unknown. Its data processing terms say it and its affiliates may transfer personal data “on a global basis”. | Links to its terms will be added here when it is named. |
| Anthropic, PBC | Planned AI provider (Claude models) that writes coaching cards and the wrap, under its commercial API terms. Requests are built to reach Anthropic through RepSidecar’s relay. | Transcript text, in short pieces as the call runs. Over one call most or all of the transcript can leave this Mac this way. Prompts and model outputs. RepSidecar is built so audio stays on this Mac. | Unknown. | Commercial Terms (effective June 17, 2025). They say “Anthropic may not train models on Customer Content from Services.” DPA (effective February 24, 2025; it is part of the Commercial Terms and has a sub-processor schedule, Schedule 4). Privacy policy. Retention. |
Anthropic retention, as its own page states it
- For API users, Anthropic automatically deletes inputs and outputs within 30 days of receipt or generation.
- Exceptions on that page: a zero data retention agreement; a service with longer retention under the customer’s control; data needed to enforce its Usage Policy; or what the law requires.
- If its systems flag a request as a Usage Policy violation, Anthropic keeps inputs and outputs for up to 2 years and safety scores for up to 7 years.
- A separate page says prompts and outputs of “covered models” (Mythos-class models) are kept for 30 days even under zero data retention, from June 9, 2026. Draft: not final Which models RepSidecar uses is not final, so whether any of them is a covered model is open.
Not chosen yet
These services are part of the plan, but no vendor is chosen. Each one is added to this list, with its terms, before it handles any personal data.
Swipe the table to see all 3 columns.
| Service | Data it would handle | Status |
|---|---|---|
| Relay host (passes transcript text to the AI provider and meters usage) | Transcript text in transit, license key, usage counts. | Host unknown. The relay is built to store no transcript text. |
| License and usage service | License key, call counts, call-hours, “call coached” events. | Vendor unknown. |
| Crash reports (opt-in) | Crash data, no transcript text. | Vendor unknown. |
| Email for receipts, the yearly reminder and change notices | Email address, plan, dates, amounts. | Our payment processor can send receipts. The sender for other notices is unknown. |