Subprocessors
Last updated: October 2026
Every third party that processes data on our behalf, what they do with it, and where they are. StageLink LLC is the controller; the companies below are processors acting on our instructions. This list is generated from the integrations the application actually uses — a service we stopped using is removed, and one we add appears here in the same change.
Infrastructure
Vercel Inc. (United States; our functions run in Washington, D.C.) — application hosting and runtime logs. Every request reaches us through Vercel, so it processes whatever a request contains.
Supabase Inc. (United States; the database is in Ohio, region us-east-2) — the application database: your account record, your sets, your tracks, your analyses. Stores everything except payment details and authentication credentials.
Accounts and email
WorkOS Inc. (United States) — authentication. Holds your email, your name if you gave one, and your password; we never receive or store the password ourselves.
Resend (United States) — transactional email: password resets and verification codes. Receives your address and the message, nothing else.
Payments
Stripe, Inc. (United States) — subscriptions and payment processing. Card details are entered on Stripe's own checkout and never touch our servers; we hold only a customer identifier and your plan status.
Optional, and only if you turn them on
PostHog Inc. (United States) — product analytics. Loads only after you accept in the cookie banner, and never if your browser sends Do Not Track. Identifies you by an internal account id, never by email, and we do not send it your IP address.
GetSongBPM (United States) — track title and tempo lookup. Used only on sets where you explicitly enable it, and it receives only artist and title. We have no data processing agreement with them, which is why it is off by default and asked for per set.
Anthropic PBC (United States) — the AI reordering suggestion. Receives track titles, artists, tempos and keys for the set being reordered when you ask for a suggestion. It never receives your email, your account, or any audio.
What never leaves your device
Audio files. When you analyse local files, the reading happens in your browser and the audio is never uploaded to us or to anyone on this list. What leaves your device is the measurements — tempo, key, energy — not the recording.
Where they are, and what that means
Most of the companies above are in the United States, so using EnergyCurve from the European Economic Area involves an international transfer. We rely on each provider's own transfer mechanism under their data processing terms.
If you want to know the mechanism for a specific provider, or you are notified of a change you object to, write to hello@energycurve.app.