Microstage — Sub-processor list

This is the public sub-processor list referenced from the Data Processing Agreement and the Privacy Policy. We keep this list current. We give customers 30 days' prior notice before adding or replacing a sub-processor (DPA §6), via the dashboard and via the change-notification email list (opt-out in your dashboard settings). If you object on reasonable data-protection grounds and we cannot resolve the issue, you may terminate the affected part of the Service.

Last updated: 6 June 2026

---

1. What is a sub-processor?

A sub-processor is a third party that processes personal data on behalf of Microstage in order for us to deliver the Service to you. We keep sub-processor relationships to the minimum needed to run the platform; each one is bound by data-protection terms no less protective than our Data Processing Agreement with you.

For each sub-processor below we list:

• Vendor — legal name of the third party.
• Purpose — what the vendor does for the Service.
• Personal data categories — the categories of personal data the vendor may process on our behalf.
• Region / location — primary processing region.
• Transfer mechanism — the lawful basis for any transfer of personal data outside the EEA (Standard Contractual Clauses with supplementary measures, the EU–US Data Privacy Framework, or processing inside the EEA only).

2. Active sub-processors

| Vendor | Purpose | Personal data categories | Region | Transfer mechanism | |---|---|---|---|---| | DigitalOcean, LLC | Compute and managed PostgreSQL hosting the Microstage application server, database, and one-pager attachment storage. | Customer account data, Visitor email and engagement data, Customer Content, system and audit logs. | Amsterdam (AMS3). | EEA processing. | | Twilio Ireland Limited | Programmable Voice (PSTN dial-in, WebRTC, conferences) for the live booth pitch and per-presenter channel routing. | Caller phone number (PSTN inbound only), country code, call timestamps, conference SIDs. We do not retain raw voice content; Twilio call recording is disabled at the account level. | Ireland; global PSTN routing via Twilio edges. | EU SCCs (module 2 — controller to processor). | | OpenAI, L.L.C. | Real-time speech translation (gpt-realtime-translate) used when the exhibitor opts in to translation. Audio is processed in transit only; no retention by OpenAI for training (opted out at the API level). | Pitch audio in transit, translated text in transit. No persistent storage of inputs or outputs on OpenAI's side. | United States. | EU SCCs (module 2) and EU–US Data Privacy Framework. | | Fastmail Pty Ltd | Transactional email delivery: magic-link sign-in for customers, follow-up emails to visitors, run summaries, and breach / sub-processor change notifications. | Recipient email, sender identity (exhibitor name and Microstage technical address), email body and attachments (one-pager PDF, demo / pricing URLs), delivery status. | Australia (primary), with delivery to global recipients. | EU SCCs (module 2). | | Google LLC (Google Analytics 4) | Website analytics on the marketing site only. Loads only after the visitor accepts analytics in the cookie banner. Not loaded on the listener page or in the customer dashboard. | Pseudonymised client identifier, page-view metadata, IP address truncated by GA at ingest. | United States. | EU SCCs (module 2) and EU–US Data Privacy Framework. |

3. Affiliates and support

Microstage operating personnel are direct employees or contractors of Microstage and are not listed as sub-processors. We do not currently engage offshore support sub-processors.

4. Customer notification of changes

We update this page when we add or replace a sub-processor. Customers can subscribe (default on for new accounts) to the sub-processor change notification list in dashboard → Settings to receive an email at least 30 days before any change takes effect. Existing customers can change their subscription at any time.

If you object to a change on reasonable data-protection grounds and we cannot resolve the issue within the notice period, you may terminate the affected part of the Service per DPA §6.

5. Earlier versions

We keep prior versions of this list for audit purposes. Email legal@microstage.io to request a copy of an earlier list along with the dates each entry was added or removed.

6. Questions

Email legal@microstage.io.