Processor and recipient register
Version 2.1.0
Version 2.1.0
Last updated: 29 September 2026.
The English text governs. The Dutch text is a translation. If they differ, the English text applies.
This register names the processors and recipients for personal ArkOffice accounts. Where Arkintel is the controller (the account, billing, security, logs, safety scoring, and a Consumer's User Content), the parties are processors and recipients. Where a Business User is the controller of personal data about other people in User Content, Arkintel is the processor, and a party in this register who receives that content is a sub-processor for that processing.
It is not a contract you click. It is not an annex to the Terms of Service. It is not a data processing agreement. The Privacy Policy incorporates this page and keeps the categories of recipients. A like-for-like swap inside a category updates this page within a reasonable time after we receive notice. A new purpose, a new flow outside the European Economic Area, or a new inference family is a material change under the Privacy Policy.
Public path: /processors.
Transfer tools below are as contracted. We do not publish a bank account number.
Roles
| Label | Meaning |
|---|---|
| Processor | Processes personal data on Arkintel's instructions when Arkintel is controller, and on the Business User's instructions when the Business User is controller of that content |
| Recipient (independent controller) | Decides some of its own purposes |
| Both | Processor for what we instruct; independent controller for that vendor's own legal duties |
| Not listed as a processor | Software we operate ourselves. Processing stays with Arkintel B.V. |
Identity providers, Stripe, and model hosts may be independent controllers for their own processing. We remain controller of what we send them when we are the controller of that data. When the Business User is the controller of that content, we send it as processor and the recipient is a sub-processor for that send.
1. Third-party processors and recipients
1.1 Hosting, delivery, and storage
| Legal name | Purpose | Personal data | Location | Transfer tool | Role |
|---|---|---|---|---|---|
| Cloudflare, Inc. | Secure traffic routing, firewall, content delivery | IP address, request metadata, cookies that are strictly necessary for delivery | Global edge | Outside the European Economic Area as the edge uses it; Standard Contractual Clauses and/or the Data Privacy Framework | Processor |
| Cloudflare, Inc. (R2) | Object storage for static landing-page and email materials, and for published legal archives | Objects we store (typically our materials, not your Drive files); IP address and request metadata when those objects are fetched | Global edge; storage region as configured | Outside the European Economic Area as the edge and R2 use it; Standard Contractual Clauses and/or the Data Privacy Framework | Processor |
| Vercel Inc. | Frontend delivery for arkoffice.com | IP address, request metadata, static assets in transit | Global edge | Outside the European Economic Area as the edge uses it; Standard Contractual Clauses and/or the Data Privacy Framework | Processor |
| Vercel Inc. (Web Analytics) | Cookieless web analytics | Aggregated usage such as page views, referring source, and region, and the request metadata used to produce those aggregates | Global edge | Outside the European Economic Area as the edge uses it; Standard Contractual Clauses and/or the Data Privacy Framework | Processor |
| IDrive Inc. (IDrive e2) | Object storage for your files | File bytes and object keys; bucket notification metadata | Dublin | Parent in the United States; Standard Contractual Clauses if the contract treats any processing as a transfer | Processor |
Vercel delivery and Vercel Web Analytics are two purposes of the same legal person. The Cookie Policy names Vercel only for the analytics product, which does not place a cookie. Cloudflare edge and Cloudflare R2 are two purposes. Your file buckets are IDrive e2, not R2.
1.2 Email
Support mail is on Google Workspace and Google Groups. Notices we originate go through Google Workspace SMTP. Resend sends only the public feedback, suggestion, and inquiry forms used without a login.
| Legal name | Purpose | Personal data | Location | Transfer tool | Role |
|---|---|---|---|---|---|
| Resend, Inc. | Messages from forms submitted without an ArkOffice login | Email address and other fields the sender enters; message content | United States and vendor regions | Standard Contractual Clauses and/or the Data Privacy Framework | Processor |
| Google LLC / Google Cloud EMEA Limited (Google Workspace, including Groups and SMTP) | Staff mail and groups; ArkOffice notices we send | Addresses, subject, body, attachments; staff group membership | United States and the European Economic Area, as Workspace operates | Standard Contractual Clauses and/or the Data Privacy Framework under the Workspace terms | Processor |
Google Places, Google sign-in, and Gemini are separate rows below.
1.3 Payment and accounting
| Legal name | Purpose | Personal data | Location | Transfer tool | Role |
|---|---|---|---|---|---|
| Stripe, Inc. and Stripe Payments Europe, Limited | Payment methods, subscriptions, invoices, and tax location as returned to us | Name, email, billing address we pass; payment-method data held by Stripe (we do not store full card numbers); customer and subscription identifiers; payment status | European Economic Area and United States, as Stripe operates | Stripe's article 28 terms; Stripe is also an independent controller for its own anti-fraud and legal duties | Both |
| Exact Group B.V. (Exact Online) | Customer invoices for tax and accounting | Invoice identity, amounts, and billing fields required for the books and tax | Netherlands and the European Economic Area | Not a transfer if processing stays in the European Economic Area | Processor |
1.4 Identity providers
Used only when you choose that sign-in. Each provider is also an independent controller of your account with that provider.
| Legal name | Purpose | Personal data | Location | Transfer tool | Role |
|---|---|---|---|---|---|
| Microsoft Corporation / Microsoft Ireland Operations Limited (Microsoft Entra ID) | Sign-in | Identifiers the provider returns (subject, email, name as configured) | European Economic Area and United States, as Microsoft operates | Standard Contractual Clauses and/or the Data Privacy Framework | Both |
| Apple Inc. | Sign-in | Identifiers Apple returns | United States and Apple regions | Standard Contractual Clauses and/or the Data Privacy Framework | Both |
| Google LLC (Google sign-in) | Sign-in | Identifiers Google returns | United States and the European Economic Area | Standard Contractual Clauses and/or the Data Privacy Framework | Both |
| Meta Platforms Ireland Limited / Meta Platforms, Inc. | Sign-in | Identifiers Meta returns | Ireland and the United States | Standard Contractual Clauses and/or the Data Privacy Framework | Both |
| GitHub, Inc. | Sign-in | Identifiers GitHub returns | United States | Standard Contractual Clauses and/or the Data Privacy Framework | Both |
| LinkedIn Ireland Unlimited Company / LinkedIn Corporation | Sign-in | Identifiers LinkedIn returns | Ireland and the United States | Standard Contractual Clauses and/or the Data Privacy Framework | Both |
1.5 Address lookup
| Legal name | Purpose | Personal data | Location | Transfer tool | Role |
|---|---|---|---|---|---|
| Google LLC (Google Places API) | Billing-address search | The search string as typed; the selected place identifier; postal fields you may save. We do not store those search strings as a product log | United States and the European Economic Area | Standard Contractual Clauses and/or the Data Privacy Framework | Processor |
Google Gemini and Google Workspace are different purposes.
1.6 Off-platform inference
Nothing is sent in the background. Only the host of the model you select receives that request. Names match the in-app disclosure.
Supplier representation: no training on your prompts or files under the supplier terms. Host retention of inference traffic is the period those terms declare.
| Legal name | Purpose | Personal data | Location | Transfer tool | Role |
|---|---|---|---|---|---|
| Mistral AI SAS | Selected Mistral Cloud chat models | Message text, and files or notes attached to that send | European Union (Mistral EU region endpoints only) | No transfer outside the European Economic Area for this processing | Processor; independent controller only if Mistral's terms keep abuse copies |
| SCALEWAY S.A.S. (Scaleway Generative APIs) | Selected Scaleway-hosted models, including Mistral and Llama served on Scaleway | The same as other inference hosts for that send | European Union datacentres | Not a transfer if processing stays in the European Economic Area | Processor |
| Google LLC (Google Gemini / Google AI Cloud) | Selected Gemini models | The same as other inference hosts for that send | United States and the European Economic Area | Standard Contractual Clauses and/or the Data Privacy Framework | Both |
| OpenAI OpCo, LLC / OpenAI, L.L.C. | Selected OpenAI models | The same as other inference hosts for that send | United States and the European Economic Area | Standard Contractual Clauses and/or the Data Privacy Framework | Both |
| Anthropic PBC | Selected Claude models | The same as other inference hosts for that send | United States | Standard Contractual Clauses and/or the Data Privacy Framework | Both |
1.7 Safety check
| Legal name | Purpose | Personal data | Location | Transfer tool | Role |
|---|---|---|---|---|---|
| Groq, Inc. | Score a chat send before the selected model | The scored prompt window, not a second copy of the full thread unless that is what we send | United States and the European Economic Area | Standard Contractual Clauses and/or the Data Privacy Framework | Processor. Host retention is the period those terms declare. You can delete a chat and add to it. If a safety check flags a send, we keep that prompt in that chat, and you can no longer delete that chat or add to it |
Groq is not a model you select. It is the safety check only.
1.8 Transcription
Audio you submit for transcription is a deliberate send. Speech-to-text and speaker separation are two purposes.
| Legal name | Purpose | Personal data | Location | Transfer tool | Role |
|---|---|---|---|---|---|
| Mistral AI SAS (Voxtral) | Speech-to-text | Audio you submit; the transcript returned | European Union (Mistral EU region endpoints only) | No transfer outside the European Economic Area for this processing | Processor; independent controller only if Mistral's terms keep abuse copies |
| pyannoteAI (commercial API at pyannote.ai) | Speaker separation | Audio uploaded for the job; job identifiers; speaker segments returned | European Economic Area. The region is set to the EEA on the pyannoteAI dashboard. | None. Processing stays in the European Economic Area. | Processor |
Mistral chat and Voxtral are two purposes of the same legal person. Speaker separation is pyannoteAI, not Voxtral.
1.9 People you choose
Not a vendor table. The Privacy Policy covers people who receive a share link or a shared Drive or Notes item, and anyone you send Output to. We do not list those people here.
2. Infrastructure we operate
These products run on systems we operate. The software licensor is not a recipient of account data merely because we use the licence. Processing on this stack is processing by Arkintel B.V.
| Component | What it does | Customer personal data |
|---|---|---|
| Ubuntu Server | Operating system | Only as applications we run store it |
| XCP-ng | Hypervisor | No customer content as a product feature |
| Xen Orchestra | Virtualisation management | Operations data |
| MongoDB | Application databases | Account, threads, file metadata, billing identifiers, logs as configured |
| Redis | Cache, sessions, pub-sub | Session and runtime identifiers |
| Ceph / MicroCeph | Cluster storage | File and object bytes we store on the cluster |
| PostgreSQL | Datastores, including the document-editing stack as deployed | Document and related records those components store |
| RabbitMQ | Job queues | Identifiers and payloads needed to run jobs |
| Traefik | Ingress | IP address and request metadata |
| pfSense | Firewall and routing | Network metadata |
| WireGuard | Private networking | Connection metadata for paths that use it |
| Flux GitOps | Deploy from git | Typically no customer content |
| Ansible | Configuration | Typically no customer content |
| GitLab Community Edition | Source and operations git | Staff and repository data, not ArkOffice user accounts |
| Uptime Kuma | Uptime checks | Typically no customer content |
| Keycloak | Identity we host; may broker the providers in section 1.4 | Account identifiers and tokens as configured |
| Apache Tika | Extract text from files on our cluster | File content submitted for extraction |
| EuroOffice | In-browser document editing we host | Document bytes while edited or stored through that stack |
If a component later moves to a vendor-hosted service, we add a section 1 row and remove the "we operate" claim for that component.
3. Not listed here
- Our staff and authorised reviewers of flagged material
- Authorities, only when the law requires a disclosure
- A cookie vendor that appears only in the Cookie Policy, unless it is also a processor. Vercel Web Analytics is a processor here. The Cookie Policy overlap is only the cookieless analytics fact
- Frozen model product names. Those can change inside a host family. The disclosure names the families
- Further sub-processors of our processors, except where a named extra row is required
4. Updates
- We receive notice of a named-vendor change.
- We update this page within a reasonable time given the impact. Time starts when we receive the notice.
- A like-for-like host inside an existing category is a register update. It is not, by itself, a new version of the Privacy Policy.
- A new purpose, a new flow outside the European Economic Area, or a new inference family follows the Privacy Policy notice, and you may end the contract before it applies.
- We change the "Last updated" date and the pack version. Earlier text stays with the other legal documents.