Subprocessors and processing records
Last updated: — disclosed under GDPR Articles 13, 28(2) and 30. Controller: RUFF UNIT SRL (Tax ID 53176530), Bucharest, Romania.
Who processes personal data for us
Jam House uses the providers below to process personal data on its behalf. Each is bound by a Data Processing Agreement (DPA) with at least the protections of GDPR Article 28(3). Public authorities receiving data as required by law (ANAF) are also listed and identified as such.
A new subprocessor is added to this page and the Privacy Policy at least 30 days before receiving any data. To object, email privacy@jamhouse.ro within those 30 days; if your objection cannot be accommodated, you can close your account without penalty.
| Provider | Role | Purpose | Location | Transfer | Documents |
|---|---|---|---|---|---|
Supabase Supabase, Inc. (Delaware, USA) | Database & storage | The authoritative database, authentication and object storage supporting the platform.
| EU — Frankfurt, Germany (data at rest); remote support access from the US | Standard Contractual Clauses (SCC) | Data is hosted in the EU region; Supabase Inc. staff in the US may access it for support and operations under the Standard Contractual Clauses in the Supabase DPA. The service role key never leaves the server runtime; the client uses the anon key with RLS. |
Supabase Auth (account verification) Supabase, Inc. (Delaware, USA) | Transactional email | Generates and validates account messages: signup confirmation, password reset and email changes.
| EU — Frankfurt, Germany; remote support access from the US | Standard Contractual Clauses (SCC) | Supabase manages authentication and code validity. Brevo delivers messages via SMTP. |
Brevo (account emails and notifications) Sendinblue SAS (France), trading as Brevo | Transactional email | Delivers authentication codes and service messages: purchases, subscriptions, withdrawals, moderation decisions and account notifications. Does not send marketing messages.
| EU — France, Germany and Belgium (hosting) | EU/EEA | The provider delivers messages; accounts, passwords and code validation are managed by Supabase. |
Google Sign-In Google Ireland Limited (Ireland) / Google LLC (US) | Sign in | Optional “Continue with Google” sign-in. Google authenticates you and returns your name, email and profile picture; used only if you choose this option.
| EU / US | EU–US Data Privacy Framework (DPF) | Google acts as an independent controller for authentication; listed for transparency. |
Vercel Vercel Inc. (Delaware, USA) | Hosting & infrastructure | Edge hosting, serverless functions and deployment platform; Vercel Web Analytics (cookieless page-view statistics, loaded only after analytics consent).
| EU — Frankfurt by default; global edge for static assets. | EU–US Data Privacy Framework (DPF) | |
Viva.com Viva Payment Services S.A. (Greece) | Payment processing | Card payment processing, 3-D Secure authentication, refunds and chargeback handling for token top-ups. Viva also acts as an independent controller for card payments (PSD2, AML).
| EU — Greece | EU/EEA | |
FGO Smart ID Dynamics SRL (Romania) | Invoicing & e-Factura | Issuing fiscal invoices and forwarding to ANAF e-Factura (RO_CIUS).
| EU — Romania | EU/EEA | Invoices are sent to ANAF e-Factura (GEO 120/2021, B2C from 2025). DPA required before launch. |
ANAF (Romanian National Agency for Fiscal Administration) Romanian Tax Authority — statutory recipient, not a processor | Invoicing & e-Factura | e-Factura (RO_CIUS) submission and DAC7 marketplace reporting.
| EU — Romania | EU/EEA | Statutory recipient under Cod Fiscal and OUG 16/2023 (DAC7). |
Record of processing activities (Art. 30)
Why we keep each type of personal data, the legal basis, who receives it and for how long. Retention periods are enforced automatically; also see Privacy Policy.
Account creation and management
Allow users to create an account, sign in, recover access, manage profile information.
- Legal basis
- Contract — Art. 6(1)(b)
- Data
- identity, contact details, profile, device data, audit log
- Data subjects
- fans, creators
- Recipients
- Supabase, Supabase Auth (account verification), Brevo (account emails and notifications), Google Sign-In, Vercel
- Transfers outside the EEA
- US — Supabase support access (SCC); US — Vercel (EU-US DPF); US — Google authentication, if used (DPF)
- Retention
- For the lifetime of the account. On deletion: disabled immediately, permanently deleted after 30 days (restoration window); the account row is then retained only in pseudonymised form for as long as the financial records referencing it are retained.
Creator onboarding (KYC + contract)
Verify creator identity, capture tax profile and signed platform contract before granting payout access.
- Legal basis
- Legal obligation — Art. 6(1)(c)Recipient identification is required for withholding and reporting tax on creator payouts (Tax Code Art. 72, 223-224; D207) and DAC7 seller verification (Tax Procedure Code, Annex 3).
- Data
- identity, identity document, tax ID, address
- Data subjects
- creators
- Recipients
- Supabase, ANAF (Romanian National Agency for Fiscal Administration)
- Transfers outside the EEA
- US — Supabase support access (SCC)
- Retention
- Identity / company document scans: deleted on account erasure. Identification details, tax residence certificate, signed contract and commission amendments: 10 years (Law 82/1991, Art. 25) — supporting the withholding applied and filed declarations.