๐†‘music-forte
Legal

Subprocessors

Third-party services that handle data on our behalf to operate Music-Forte. Each is listed with what it does, what it receives, and where it processes data.

Last updated ยท May 2026

Current subprocessors

Cloudflare (Pages, D1, R2, AI Gateway, Durable Objects)
Purpose
Hosting the platform, database, file storage, edge caching, AI gateway routing.
Data
Account data, conversations, drafts, practice sessions, recordings, request logs.
Region
Global edge; primary regions Europe and the US.
DeepSeek
Purpose
Primary language model for the chat assistant, lesson generation, and Practice coaching narratives.
Data
Prompt text + structured assessment summaries when you trigger an AI feature. Audio recordings are NEVER sent.
Region
China (DeepSeek's API endpoints).
OpenRouter
Purpose
Fallback model gateway when DeepSeek is unavailable, plus access to specialised models (Qwen3, Kimi K2.6) for code-shaped tools and OMR.
Data
Prompt text only.
Region
United States (OpenRouter's infrastructure).
Modal
Purpose
GPU inference for music-generation expert models (choral_baroque, hymn_satb, folk_monophonic) and OMR / source separation services.
Data
Inputs to the relevant model โ€” typically a structured prompt, sometimes a short audio clip when you opt to upload one.
Region
United States.
Resend
Purpose
Transactional email โ€” sign-up verification, password reset, draft-share invites.
Data
Email address, sender/recipient metadata, message body.
Region
United States / Europe.
Deepgram
Purpose
Optional voice-to-text for the voice composer surface (when enabled). Pitch detection runs in your browser; only when you use voice DICTATION does audio go to Deepgram.
Data
Audio of your voice during dictation.
Region
United States.
Exa
Purpose
Background search used by some teacher-mode tools (citations, source lookups).
Data
Search queries derived from your prompt.
Region
United States.

Data-protection arrangements

Each subprocessor is engaged under its standard data-processing terms (Cloudflare DPA, OpenAI-compatible provider agreements, etc.). Where the destination jurisdiction does not provide adequacy under UDPPA / GDPR equivalent standards, transfers rely on Standard Contractual Clauses or equivalent safeguards.

Adding a new subprocessor

We'll update this page when we add a subprocessor that receives personal data. Material additions are also announced in-product. If you depend on a specific stable set of subprocessors (e.g. for institutional procurement), email support@music-forte.app and we'll notify you directly before changes that affect you.

Services we don't use

  • Google Analytics, Facebook Pixel, or any third-party advertising / tracking pixels.
  • External CDNs for fonts beyond Google Fonts CSS preconnect (which doesn't identify users).
  • Any service that would require us to share your conversations or recordings to receive its product.
We deliberately keep this list small. Every dependency is a privacy and reliability surface; we add them only when the feature is worth the trade.