Processors we use
Art. 28 and Art. 13(1)(e) GDPR · Last changed: 23 August 2026
Blurt is the controller for everything that happens on the managed Cloud plan. The companies below are our processors: they act on our instructions, for the purpose named in their row, and nothing else. None of them is allowed to use your voice or your text to train a model, and we sell nothing to anyone.
If you use on-device dictation — the default on Apple Silicon — this page does not apply to you. In that mode your audio and text never leave your Mac and no company on this list receives anything.
Our promise about changes
We announce a new processor on this page normally at least 30 days before it starts receiving any of your data, and we date every change. If you object to a new processor you may terminate your subscription free of charge before it takes effect and we refund the unused part of what you paid. Removing a processor, or narrowing what one receives, takes effect immediately — that needs no notice period.
The one exception, stated plainly rather than discovered later. A provider can fail, withdraw its service, or develop a security problem. If we have to replace one at short notice to keep the service running or to protect your data, the change happens sooner than 30 days — and we then update this page without delay, naming the new provider, the date and the reason it could not wait. We will not use that exception to sidestep the notice period; your right to object and to terminate free of charge is unaffected, and it applies from the moment you learn of the change.
Want to be told rather than having to check? Email support-blurt@chbnk.one with "processor updates" and we will write to you before each change.
Who receives your voice
Scroll the table sideways to see every column.
| Provider | What it receives | Purpose | Location | Transfer basis |
|---|---|---|---|---|
| Soniox, Inc. | Your voice audio | Live streaming transcription — the words in the pill while you hold the key. Default. | USA | DPF adequacy where certified, otherwise SCC Module 2 |
| ElevenLabs, Inc. | Your voice audio | Live streaming transcription — the alternative live model, used when you select it. | USA | DPF adequacy where certified, otherwise SCC Module 2 |
| Groq, Inc. | Your voice audio | Batch transcription of the recording sent after you release the key. Default. | USA | DPF adequacy where certified, otherwise SCC Module 2 |
| OpenAI, L.L.C. | Your voice audio | Batch transcription when you pick an OpenAI speech model. | USA | DPF adequacy where certified, otherwise SCC Module 2 |
Who receives your transcript
| Provider | What it receives | Purpose | Location | Transfer basis |
|---|---|---|---|---|
| OpenRouter, Inc. | Transcript text | Routes the default clean-up model to one of the two hosts below. Default. | USA | SCC Module 2, incorporated by § 13.2 of its data processing agreement |
| Baseten Labs, Inc. | Transcript text | Runs the default clean-up model. One of only two hosts OpenRouter may use — fallback beyond this list is switched off in our configuration. | USA | DPF adequacy where certified, otherwise SCC Module 2 |
| Nebius B.V. | Transcript text | Runs the default clean-up model. The second and last permitted host. | Netherlands (EU) / Finland | Inside the EEA — no transfer mechanism needed |
| DeepInfra, Inc. | Nothing since 23 August 2026 | Withdrawn. Ran the alternative clean-up models until 23 August 2026, when they were withdrawn and every request moved to the default. It now serves no model and receives no data at all. Kept on this list rather than deleted, because it did receive transcript text before that date. | USA | DPF adequacy where certified, otherwise SCC Module 2 |
| OpenAI, L.L.C. | Transcript text | Runs the OpenAI clean-up model, and is the fallback for any model not listed above. | USA | DPF adequacy where certified, otherwise SCC Module 2 |
| Cerebras Systems Inc. | Nothing today | Standby only. Configured in our backend but serving no model, so it currently receives no data at all. Listed so that switching it on is never a surprise — and we would announce that here like any other change. | USA | DPF adequacy where certified, otherwise SCC Module 2 |
Everything else
| Provider | What it receives | Purpose | Location | Transfer basis |
|---|---|---|---|---|
| Hetzner Online GmbH | Everything our backend holds | Hosts the Blurt backend and the PostgreSQL database. | Germany | Inside the EEA — no transfer mechanism needed |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Email, card details, billing address, subscription state | Takes payment and manages the subscription. Never receives audio or transcripts. | Ireland (EU) with US group companies | Intra-group SCCs; DPF adequacy for the US entity where certified |
| Resend (Plus Five Five, Inc.) | Email address and the content of our emails to you | Sends email verification, password reset, the subscription confirmation and support replies. Never receives audio or transcripts. | USA | DPF adequacy where certified, otherwise SCC Module 2 |
| Apple Inc. | Sign-in identifier and email | Only if you choose "Sign in with Apple". Here Apple is an independent controller for its own sign-in service, not our processor. | USA / Ireland | Apple's own terms and transfer mechanism |
| Google LLC | Sign-in identifier and email | Only if you choose Google sign-in. Independent controller for its own sign-in service, not our processor. | USA / Ireland | Google's own terms and transfer mechanism |
Transfers outside the EEA
Where a row says DPF adequacy where certified, we rely on the European Commission's adequacy decision of 10 July 2023 for the EU–US Data Privacy Framework when that company holds a current certification — you can verify any of them in the official DPF list. Where it does not, we rely on the Standard Contractual Clauses in the version adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), as contained in that provider's data processing terms, plus the supplementary measures described on our security page.
We say plainly what that does and does not buy you: the United States does not offer protection identical to the EEA, and US authorities have access powers with no EU equivalent. If that matters to you, use on-device mode — nothing on this page applies to it.
Ask us which mechanism applies to a specific provider and we will answer in writing: support-blurt@chbnk.one.
Change log
- 26 August 2026 — no change to this list. Blurt gained optional usage analytics (opt-in, off by default, described in Section 7 of the Privacy Policy). It is recorded here precisely because it added nobody: the events are processed on the same Hetzner infrastructure in Germany as the rest of the service, in the same database, and no analytics provider was engaged. A feature of this kind normally arrives with a new name on a list like this one, so its absence is worth stating rather than leaving to be noticed.
- 23 August 2026 — first published. Added to the public record: ElevenLabs (voice), OpenRouter and its two permitted hosts Baseten and Nebius (text), Cerebras (standby, receiving nothing), and Hetzner (hosting), all of which were already part of the service but were not named in the Privacy Policy. DeepInfra was withdrawn the same day: the two alternative clean-up models it ran were retired and every request moved to the default, so it now receives nothing. It is listed above rather than omitted, because it did receive transcript text until that date.
Related
See our Privacy Policy for what each provider does with the data, the security page for how it is protected, the data processing agreement if you use Blurt as a business, and the Terms of Use.