Subprocessor List for Kolla
Last updated: October 8, 2026
This translation is provided for convenience; in case of conflict the Swedish version prevails.
This page lists the suppliers that process personal data on behalf of Lind Studio AB when we provide Kolla. It also explains where the Service is hosted and the formats in which the Customer's data can be exported. This page forms part of our General Terms and the Data Processing Agreement in Appendix 1 to those Terms.
1. Subprocessors
The subprocessors below process personal data on our behalf as part of our role as processor for the Customer. No subprocessor may use the data for its own purposes.
| Supplier | Service | Data processed | Country of processing | Transfer mechanism |
|---|---|---|---|---|
| Convex, Inc., 444 De Haro Street, Suite 218, San Francisco, CA 94107, USA | Kolla database, file storage, and backend | All Customer Content, including images, video, text, comments, and approvals; account and contact details; Reviewer details; and technical logs | USA (AWS, US East) | European Commission Standard Contractual Clauses |
| Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA | Hosting for kolla.media and app.kolla.media, page delivery, and image optimization | IP address, browser information, requested pages, images displayed in the Service, and temporary server logs | USA, with global delivery nodes | EU-U.S. Data Privacy Framework certification and Standard Contractual Clauses |
| WorkOS, Inc., 548 Market Street PMB 86125, San Francisco, CA 94104, USA | Authentication, accounts, Organizations and roles, and invitations | Name, email address, profile picture, login details, IP address at sign-in, Organization membership, and Reviewer records | USA | European Commission Standard Contractual Clauses |
| Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA | Email delivery for review requests, notifications, and onboarding emails | Name, email address, message content, and delivery status | USA | EU-U.S. Data Privacy Framework certification and Standard Contractual Clauses |
| PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA | Usage analytics, error reporting, and feature management in Kolla | User ID, email address and name of signed-in Users, Organization name, Service events, browser, device, and IP address | USA | EU-U.S. Data Privacy Framework certification and Standard Contractual Clauses |
We have entered into data processing agreements with all subprocessors. The subprocessors may in turn engage their own subcontractors, such as Amazon Web Services for data centers, in accordance with their published lists.
2. Other recipients
The following suppliers receive personal data but act as independent controllers for their processing and are therefore not subprocessors. Our Privacy Policy describes them.
| Supplier | Role | Data |
|---|---|---|
| Polar Software, Inc., 3500 South DuPont Highway, Dover, DE 19901, USA | Subscription seller and merchant of record, payments, invoicing, and VAT | Billing details, payment card details, and payment history |
| Meta Platforms Ireland Limited | Advertising measurement and targeting, only for visitors who have consented to cookies | Visit data, cookie identifier, email address, and conversion events |
| Google Ireland Limited | Advertising measurement and targeting, only for visitors who have consented to cookies | Visit data and cookie identifier |
3. Changes to the list
We notify the Organization's administrator by email at least 30 days before a new or replacement subprocessor starts processing personal data, and we update this page. The Customer may object under the Data Processing Agreement. If a subprocessor must be replaced urgently, for example because of a security incident, we inform the Customer as soon as possible.
4. Where Kolla is hosted
Kolla's infrastructure is hosted by Convex and Vercel in the United States. It is therefore subject to U.S. jurisdiction in addition to the Swedish and European laws that apply to us. In certain circumstances, U.S. authorities may request data from suppliers in the United States.
To protect the Customer's data against access that would breach EU or Swedish law:
- all data is encrypted in transit and at rest by the suppliers,
- our data processing agreements include Standard Contractual Clauses that require suppliers to challenge disproportionate government requests, inform us when the law permits, and disclose only the minimum required,
- we do not send Customer Content to Polar or recipients other than the subprocessors listed above, and
- we assess suppliers' level of protection before replacing or adding a subprocessor.
We do not disclose the Customer's data to any authority without a binding decision and inform the Customer when the law permits.
5. Export and switching provider
The Customer may request an export of its data at any time under section 12 of the General Terms. The export is provided free of charge and includes the following data in the following formats:
| Data | Format |
|---|---|
| Uploaded images, videos, and cover images | Original files in their original formats, such as JPEG, PNG, WebP, MP4, and MOV |
| Projects, clients, and contacts | JSON or CSV |
| Posts with captions, type, order, and version history | JSON or CSV, with references to the files above |
| Review requests, decisions, comments, and timestamps | JSON or CSV |
| Users in the Organization | JSON or CSV |
The export is delivered as a downloadable archive. Send the request to hello@kolla.media. Kolla does not currently have a public API. If we introduce one, we will describe it here.
6. Contact
Send questions about subprocessors, data location, or exports to hello@kolla.media.