Sergio — Subprocessor List
Version: 1.0
Last updated: 12 October 2026
Effective date: 15 October 2026
Controller/processor service: Antaris Labs SRL / Sergio
This list identifies the service providers that Antaris Labs SRL (Antaris) may use as subprocessors when Antaris processes Customer Personal Data under its customer Data Processing Agreement (DPA). It is not a list of every website recipient or every company that may independently control data for a separate purpose.
Important: Customer Personal Data means personal data Antaris processes on a Customer’s documented instructions. Antaris’s own billing/tax, public website, payment-provider and legal-compliance activities can be independent-controller processing and are described in the Privacy Notice. The applicable DPA determines whether a provider is an authorised Subprocessor for a particular Customer data flow.
1. Change-notice process
Customers authorise the subprocessors shown below under the DPA’s general-authorisation mechanism. Antaris will give at least 30 days’ advance written notice of a proposed addition or replacement that will process Customer Personal Data, except where a shorter period is reasonably necessary for security, legal compliance or urgent service continuity.
The notice will be delivered by email to the Customer’s nominated privacy/contract contact or by a customer-portal alert sent to that nominated contact. A public-list update supplements but does not replace direct notice. Antaris will retain delivery/version evidence. The notice will identify the proposed provider, function, relevant processing/transfer information and expected effective date. A Customer may object in writing on reasonable data-protection grounds before the effective date. The parties will seek a reasonable solution; if no reasonable solution is available and the provider is necessary for the affected service, the Customer may terminate that affected service before the change takes effect in accordance with the DPA.
Current and archived versions can be requested from privacy@sergiosommelier.com.
2. Approved subprocessors
| Provider / legal entity | Processing purpose | Categories of Customer Personal Data | Main location / access model | Transfer safeguard and status |
|---|---|---|---|---|
| Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, and its subprocessors | Database, authentication, file storage and server functions supporting Sergio | Customer account/workspace data; Customer Content; uploaded files; QR guest event data; derived venue insights; service metadata | Sergio’s primary project region is West EU (Ireland). Supabase server functions, backups, support and onward subprocessors may process data elsewhere; its current onward subprocessor list is maintained at supabase.com/legal/customer-resources/subprocessor-list. | Supabase Data Processing Addendum, Version 1 (1 August 2026). Where a GDPR-restricted transfer occurs, the relevant SCC module applies: Module 2 for controller-to-processor and Module 3 for processor-to-subprocessor transfers; the DPA also includes applicable UK and Swiss addenda. |
| Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland, and its subprocessors (Gemini API) | AI-assisted extraction, classification, wine profiling and translation when Customer activates the feature | Submitted document/image/text content and feature prompts/responses; no QR guest session data | Google or its subprocessors may process data where they maintain facilities; its subprocessors are listed at cloud.google.com/terms/subprocessors. | Google’s applicable Processor Terms and related service terms. Google Search grounding may retain prompts and grounded results for up to 30 days, and a configured feature may use a preview model. Where a GDPR-restricted transfer occurs, the applicable transfer route is determined under the applicable terms, including the applicable Standard Contractual Clauses where required. |
| Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland (Google Workspace, Gmail SMTP) | Account confirmation, password reset and service/support email | Customer account/contact email, name, relevant message content and delivery/security metadata | Google or its subprocessors may process data where they maintain facilities. | Google Workspace data-processing terms. Where a GDPR-restricted transfer occurs, the applicable transfer route is determined under those terms, including the applicable Standard Contractual Clauses where required. |
| Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus | Static website hosting, DNS and technical request logging for public Sergio pages, including QR page requests | IP address, User-Agent, request URL, timestamp, status and related technical log data; a QR request URL may identify the Venue | Server in France (EU). Server logs kept seven days. Weekly backups of the website files, kept six weeks. The onward chain is governed by the Hostinger DPA. | Hostinger DPA and applicable SCCs where a restricted transfer occurs. Hostinger is authorised only for this limited hosting/logging function. |
3. Processing boundaries and providers not automatically listed as subprocessors
The following are not automatically Subprocessors for Customer Personal Data, but Antaris must classify their actual role and disclose/govern the applicable processing:
| Provider/category | Why not automatically a Customer-data Subprocessor | Required treatment |
|---|---|---|
| Stripe | Stripe provides payment services for Antaris’s subscription billing. Depending on the enabled product and data flow, it may act on Antaris’s instructions or as an independent controller for its own purposes. It is not listed as an authorised subprocessor for Customer Personal Data under this DPA. | Stripe’s payment processing is governed by its own applicable terms and privacy information. |
| Cloudflare, Inc. | Cloudflare Turnstile protects Antaris’s public account-sign-up form and processes technical request data for that Antaris controller-side activity. | It is not listed as an authorised subprocessor for Customer Personal Data under this DPA. |
| GitHub | Used for source-code/deployment workflow and not for Customer Personal Data. | Antaris keeps Customer Content, production exports, credentials and personal-data-bearing logs out of repositories, issues, CI logs and deployment artefacts. |
| Professional advisers and authorities | May receive data under independent confidentiality, legal or regulatory duties rather than to provide the instructed processing service. | They receive data only where necessary and subject to confidentiality or legal duty. |
4. International transfers
Some approved Subprocessors may process Customer Personal Data outside the European Economic Area (EEA), including through remote support, global infrastructure or onward subprocessors. Where a GDPR-restricted transfer occurs, Antaris uses the transfer safeguard required for the actual flow, including an adequacy decision, a valid EU–US Data Privacy Framework certification where applicable, or the European Commission’s Standard Contractual Clauses with any required supplementary measures.
Customers may request further information about relevant safeguards by contacting privacy@sergiosommelier.com, subject to reasonable confidentiality and security protections.