Subprocessors

These are the companies that process the paid service's customers' personal data for us, with what they do and where. We give at least 30 days' notice by email to account holders before we add or replace one. See the DPA and the Privacy Policy.

[OWNER: confirm each country and region before launch. Entries marked 'confirm' are best-effort from our configuration.]

The free local tool runs on your machine and sends nothing to us, so it has no subprocessors. This website is hosted on Vercel (listed below) and counts page views with Plausible Analytics (listed below); it uses no other processor. The model and voice providers that you configure in the tool are your suppliers, not ours (see the last entry).

Purpose: hosts the console and its API, and runs the daily jobs. It receives every request and holds server logs. Location: Sydney, Australia (region syd1) for compute; the edge network is global. United States company.

Purpose: sign-in (Supabase Auth), the Postgres database, and private file storage for team files. Location: [OWNER: confirm the project region, target Sydney, ap-southeast-2]. United States company.

Purpose: payments, subscriptions, invoices and tax. Receives billing contact and card details. Also an independent controller for fraud and regulatory purposes. Location: United States and other countries.

Purpose: sends outreach mail and our own transactional email (for example verification links); reports delivery events. Receives recipient addresses, names and message content. Location: United States [confirm].

Purpose: Cloud Run Jobs and Cloud Storage run cloud renders (scene files, audio, output video). The YouTube Data API supplies public YouTube data and, with your credentials, your own channel's data. Location: render region [OWNER: confirm, target Sydney, australia-southeast1]; the YouTube API is global.

Purpose: licensed provider of public TikTok, Instagram and YouTube profile and post data for the Research plan. Receives our queries (handles, keywords). Location: [OWNER: confirm company and country]. May act as an independent controller or a processor. [LAWYER: confirm role]

Purpose: licensed provider of public social data for the Research plan. Receives our queries (handles, keywords). Location: [OWNER: confirm company and country]. [LAWYER: confirm role]

Purpose: the Reddit API supplies public posts for topic research. Receives our queries. Location: United States. Reddit decides how it handles the request under its own terms.

Purpose: receives error reports from the console and the staff admin when they fail. We strip the user, email addresses, tokens, cookies, request headers, bodies and query strings first. Location: United States (Sentry has no Australian region) [OWNER: confirm the Sentry data region and retention]. Used only while a Sentry project is configured.

Purpose: cookieless page-view counts for this website and the console's public pages. It receives the page address, the referrer and coarse device details; it sets no cookie and keeps no personal profile. Location: European Union (Estonia company, EU-hosted). Used only while we have it switched on.

Purpose: hosts the public documentation. It receives the visitor requests for the docs site. No customer content is sent to it. Location: United States.

The console does not send your scripts or content to a language-model or voice provider. If you choose one in your own local tool (for example an OpenAI-compatible or Anthropic model, or an OpenAI voice), the local tool sends the text with your own key under that provider's terms. That provider is your supplier, not our subprocessor. [OWNER: add any provider that the hosted service starts using for the customer's content, and give notice first.]