This page lists by name the providers that process personal data on behalf of Pierre Debski, trading as dkp-consult, publisher of Rephrase and data controller. For each one: its role, the data concerned, its location and, where applicable, the basis for any transfer outside the European Economic Area (EEA). A data processing agreement (Article 28 GDPR) is in place with each of the providers in section 1. This page supplements section 6 of the Privacy Policy.

1. Sub-processors

1.1. Hostinger

  • Provider: Hostinger International Ltd (Cyprus)
  • Role: Rental of the virtual private server (VPS) that runs the website, the API and the database.
  • Data concerned: All service data: account, submitted and humanized texts, personalized writing styles, glossary, history, billing data kept by Rephrase, technical logs.
  • Location: France (European Union): the server is located in a Hostinger data center in Paris.
  • Transfer outside the EEA: No transfer planned by the publisher.

1.2. Coolify Cloud

  • Provider: coolLabs Technologies Bt. (Hungary)
  • Role: Server management: deployment of new versions, configuration, access to technical logs.
  • Data concerned: Technical access to the server and its configuration. This provider can therefore access the data hosted on the server, strictly within the limits of this task.
  • Location: Depends on the Coolify Cloud infrastructure, being verified.
  • Transfer outside the EEA: Where applicable, governed by coolLabs’ data processing agreement.

1.3. OpenAI

  • Provider: OpenAI (United States)
  • Role: Language models that produce the humanized texts and analyze the samples of personalized writing styles.
  • Data concerned: The texts you submit, from the website, the Chrome extension or the public API (including the text extracted from the Word or PDF files you upload), the writing samples of a personalized style and the related rewriting instructions. Your email address and name are not sent.
  • Location: United States.
  • Transfer outside the EEA: European Commission Standard Contractual Clauses, provided for in OpenAI’s data processing agreement.

1.4. Stripe

  • Provider: Stripe Payments Europe, Limited (Ireland), with Stripe, Inc. (United States)
  • Role: Payment collection, invoices, billing portal. For some of its own obligations (fraud prevention, financial regulation), Stripe acts as an independent controller.
  • Data concerned: Email address, internal account identifier, billing name and address entered at checkout, payment history. Card data is entered on Stripe and never passes through Rephrase.
  • Location: European Union and United States.
  • Transfer outside the EEA: European Commission Standard Contractual Clauses, provided for in Stripe’s data processing agreement.

1.5. PostHog

  • Provider: PostHog, Inc. (United States), European instance
  • Role: Audience measurement and analysis of how the service is used; session recording on public pages, if you consent.
  • Data concerned: Page views and actions in the service, IP address and browser; if you accept analytics cookies, a cookie identifier and the link to your account (internal identifier, email address, name). Never the content of your texts.
  • Location: PostHog’s European instance (EU Cloud), to which Rephrase sends all its analytics data.
  • Transfer outside the EEA: As PostHog, Inc. is an American company, access from the United States remains possible; it is governed by the Standard Contractual Clauses provided for in PostHog’s data processing agreement.

1.6. Resend

  • Provider: Resend, Inc. (United States)
  • Role: Sending of transactional emails: address confirmation, sign-in link, password reset, purchase and subscription confirmations, account deletion.
  • Data concerned: Your email address, your name and the content of the email. Your texts are never sent to Resend.
  • Location: Resend’s infrastructure.
  • Transfer outside the EEA: Processing in or access from the United States remains possible; it is governed by the Standard Contractual Clauses provided for in Resend’s data processing agreement.

1.7. Google Workspace

  • Provider: Google (Google Workspace)
  • Role: Hosting of the contact@rephrase.fr mailbox, which receives your questions, your GDPR requests and the replies to the service’s emails.
  • Data concerned: The content of the emails you send us, your email address, your name and attachments.
  • Location: Google’s global infrastructure; data may be processed outside the EEA.
  • Transfer outside the EEA: European Commission Standard Contractual Clauses, provided for in the Google Workspace data processing agreement.

2. Publisher’s own tool

Recalled (recalled.dev) is a security audit log service operated by the publisher itself (Pierre Debski, dkp-consult). It is therefore not a third-party provider. It receives the actions carried out on the accounts (sign-up, sign-in, humanizations without their content, purchases, administration actions) with the identifier, email address and name of the person concerned, the IP address and the browser, as well as the names given to writing styles and the glossary terms, and, only if you have accepted analytics cookies, the text typed into the home page demo (limited to 2,000 characters), with your IP address and browser.

3. Services used in their own name

Sign in with Google. If you choose to sign in with your Google account, Google authenticates you and sends us your email address and name. Google then acts as an independent controller for your Google account, under its own privacy policy; it is not a sub-processor of the publisher.

Anti-bot protection. The sign-in and sign-up forms use Cloudflare Turnstile. Your browser loads the Turnstile widget from Cloudflare’s servers, and our server sends Cloudflare the verification token with your IP address. Cloudflare processes these technical signals under its Turnstile privacy addendum.

Chrome extension. The extension is distributed through the Chrome Web Store, a Google service that acts in its own name. The extension itself only communicates with rephrase.fr and api.rephrase.fr.

4. Changes

Any addition or replacement of a sub-processor is reflected on this page, with the date of the update. For any question about this list, or to obtain the safeguards that apply to a provider, write to contact@rephrase.fr.