Version 2026-10-30.1. Effective 2026-10-30.
AECH CO trading as Mindstamp uses the providers below to operate the service. The data sent depends on the features and instructions used by the Customer. This directory distinguishes service processing from Mindstamp's own business activities and customer-contracted services.
The DPA and the Customer's completed processing profile govern Customer Personal Data. Mindstamp preserves the applicable directory with the accepted agreement. DPA section 6 governs later subprocessor additions or replacements, notice and objections.
Service providers
| Provider | Purpose and data | Processing locations and scope |
|---|---|---|
| Amazon Web Services | S3 storage and delivery of media, documents, audio, transcripts, generated files, archives and offline packages. Customer content can contain personal data. | Mindstamp storage includes US East (N. Virginia), US West (N. California) and US West (Oregon). Storage location alone does not describe every support or delivery location. |
| Salesforce / Heroku | Application hosting, Heroku Postgres, Key-Value Store and Scheduler. Processes service records, viewer data and content. | The production application and database are in the United States. The database location does not establish residency for the entire service. |
| Cloudflare | Edge delivery, protection, request metadata and location headers. Turnstile can also process connection and challenge data. | Global edge processing. Some Cloudflare services have a separate controller role under their terms. |
| BunnyWay, informacijske storitve d.o.o. (bunny.net) | Video storage, transcoding and playback delivery. Processes media, identifiers and delivery metadata. | The default Stream library uses Frankfurt, London, Stockholm, Los Angeles, New York, Singapore, Sydney and Sao Paulo storage locations. Enterprise libraries can have separately agreed storage settings. CDN delivery and other service processing are separate from the selected storage region. |
| Functional Software, Inc. (Sentry) | Error monitoring and diagnostics. Events can contain user identity and request or client context. | Mindstamp uses US organisation hosting. Other provider support and onward processing can follow the applicable provider terms. |
| Postmark (ActiveCampaign) | Email delivery. Service messages can contain account, viewer and content references. | US infrastructure. The applicable service settings govern message and event retention. |
| Positionstack (APILayer) | Reverse geocoding of viewer-provided coordinates for the enabled coordinate-to-address feature. | The exact processing countries and applicable account contracting entity remain under review. Do not assume this feature provides UK- or EEA-only processing. |
| AssemblyAI, Inc. | Transcription and captions. Receives source media URLs, audio or video, associated metadata and transcript data. Eligible trial uploads can start transcription automatically. | Mindstamp uses the general API endpoint and a 30-day account TTL. Model-improvement sharing is disabled. These settings do not establish zero retention, one period for all metadata or regional processing. |
| OpenAI | Requested AI answers, transcription, translation, generated speech, embeddings and related features. Depending on the feature, receives prompts, transcripts, questions, audio and context. | Mindstamp uses standard API settings without special regional-processing or retention terms. Model-improvement sharing and API call logging are disabled; audit logging is enabled. Provider retention varies by endpoint. These settings do not establish zero retention. |
| Google Workspace | Support and privacy correspondence at [email protected]. Messages can contain customer personal data or support exports. | Processing follows the applicable Workspace agreement and service configuration. No separate Mindstamp support ticket system is used. |
Bunny confirmed on 29 October 2026 that its standard DPA covers AECH CO using its services on behalf of customers, including Bunny acting as processor or subprocessor. Bunny states that global Stream replication is internal processing by BunnyWay and that its infrastructure providers supply capacity and hosting without logical access to customer data. On that stated basis, Bunny does not identify a separate Chapter V transfer instrument for that internal processing. Mindstamp retains the accepted DPA and this confirmation in its provider record. The storage locations above remain relevant. This does not replace the UK IDTA for a customer's restricted transfer to AECH CO or provide regional residency for the full service.
Mindstamp's service accounts are held by AECH CO. Where a table uses a provider brand or group name, the exact contracting entity follows the applicable account agreement. Mindstamp is still reconciling some account entities and processing-country records. This directory does not promise UK- or EEA-only storage or complete verification of every onward route.
Mindstamp business recipients
These services primarily support Mindstamp's own account, billing, marketing and business activities. A provider can also be a subprocessor where it handles Customer Personal Data to deliver the Customer's service.
| Recipient | Data and purpose |
|---|---|
| Stripe | Billing contacts, subscriptions, invoices, payment and transaction status. Stripe also has independent controller functions. Customer merchant payments are described below. |
| Backpack Internet Pty. Ltd. trading as Bento Software | Account, plan, lifecycle, lead and service communications. Mindstamp preserves supported server account events. App browser identification and page tracking are removed in this release. Historical viewer-coordinate events require a separate retained-data review. |
| Rewardful (retired) | The affiliate program has ended and its application integration has been removed. Historical affiliate, referral, conversion and commission records can remain with the provider or in account and billing records. |
| Google Analytics and Ads | Marketing-site measurement, attribution and conversion data, subject to the visitor's category choices. Mindstamp's own app and player Analytics and Ads tags are removed in this release. |
| LinkedIn, Meta and X | Marketing-site advertising and conversion data when the relevant tag is configured and the visitor permits marketing storage. |
| Google Fonts | Font delivery can send connection metadata to Google when a page requests a font from its service. |
| Pixabay and other selected stock sources | Stock searches and returned creator or media metadata. The reviewed Pixabay path sends search terms and retrieves stock assets. |
Customer-contracted services
Customers can connect services through their own accounts, OAuth permissions, API tokens, webhooks and media hosts. Supported paths include Google Drive and Sheets, HubSpot, Shopify, Constant Contact, ClickFunnels, HeyGen, Synthesia, Vimeo, Wistia, YouTube, Loom, Kaltura, Panopto and JW Player. Customer merchant paywalls can use Stripe Connect.
The Customer selects and contracts these services. Their terms and privacy information apply to the data they receive. Mindstamp still protects connection credentials and follows the Customer's lawful instructions for its own processing.
Customers can enable their own Google Analytics or Meta pixels at account or video level. These tags load only when configured by the video owner. The Customer must provide the required information and consent controls in its viewing or embedded environment. Mindstamp does not show a cookie popup in the app or player. Account signup does not by itself establish consent for every optional tracking purpose.
Retired services and retained copies
The owner reports that Customer.io was replaced by Bento and its account data was deleted, and that Mux and Coconut are no longer used and hold no current customer files. IPStack is retired; Positionstack serves the separate coordinate-to-address path. Support Brain is discontinued. Historical local records, exports, backups and provider copies remain subject to inventory and disposal checks; retirement alone does not prove erasure.
Mindstamp does not use customer video content for internal AI product or sales research outside a customer-requested task, as confirmed by the owner. Scheduled monthly AI account reports are disabled. The organisation AI control for Mindstamp MCP does not turn off every separate AI path, including eligible automatic transcription.
Retention and questions
Deleting a live record, expiring a link and deleting a retained provider or backup copy are different operations. Retention depends on the service, record and applicable exception. Old S3 versions do not currently have a verified seven-day maximum. Mindstamp does not promise total erasure or one retention period for every record.
Email [email protected] for the provider information that applies to your processing profile, a subprocessor objection or a privacy request. The AI governance page, Privacy Policy and Cookie and Storage Notice describe related processing.