Legal
Sub-processors
Last updated: 2026-07-28
The following third-party services process personal data as part of the Service. Each is bound by a Data Processing Agreement (DPA) with us and processes data only on our documented instructions.
Data transfers to non-EU sub-processors happen under the EU Standard Contractual Clauses (SCCs).
| Sub-processor | Purpose | Data | Region |
|---|---|---|---|
| Supabase Privacy Policy | Auth, PostgreSQL database, file storage | Email, uploaded content, generated outputs, usage counters, face photos, reference thumbnails | EU (Ireland) & US |
| Vercel Privacy Policy | Application hosting, serverless compute, edge network | HTTP request metadata, server logs, temporary in-memory copies of processed content | US (primary), global edge |
| Anthropic Privacy Policy | Claude LLM — text generation, voice fingerprinting, prompt writing | Transcripts, voice samples, prompts including reference thumbnail images | US |
| OpenAI Privacy Policy | GPT-4o vision — thumbnail style extraction; Whisper — audio transcription fallback | Reference thumbnail images, audio content | US |
| fal.ai(proxying Google’s nano-banana-pro) Privacy Policy | Thumbnail image generation | Face photo, reference thumbnails, text prompt | US |
| Groq Privacy Policy | Primary Whisper endpoint (audio-to-text) | Audio content only | US |
| Polar.sh Privacy Policy | Subscription billing, payment processing | Email, billing address, payment info, subscription state | US |
| Publer (optional — only when connected) Privacy Policy | Push generated drafts to your Publer workspace | Generated post text, your Publer API key | Malta (EU) |
Changes
We update this list when we add or replace a sub-processor. Material changes to what data leaves the EU or to a sub-processor’s role are communicated to paid customers by email at least 15 days in advance.