Subprocessors
These are the companies that process data on our behalf. Each one is listed here before it receives anything, not after.
Our hosting provider processes every request to the application. Every other vendor sees only what is sent to it, which is listed per vendor below.
Each of these vendors engages subprocessors of its own. Where a vendor publishes that list we link to it rather than copying it, because a copy of someone else’s list goes stale without anyone noticing; where we could not find one, the entry says so instead of implying we checked.
This page is a register of processors. It is not our privacy notice.
Current
Pexels
Canva Germany GmbH (Pexels)Optional stock video search and footage retrieval
- What they receive
- Search keywords explicitly submitted by the creator
- Catalog result identifiers and API request metadata
- Where
- Not verified; see the linked privacy policy
- Receiving data now
- Preview deployments, Local development
- Their own subprocessors
- The privacy policy describes affiliates and service providers; a dedicated downstream processor list has not been verified. https://www.pexels.com/privacy-policy/
Vercel
Vercel Inc. (US)Application hosting and edge routing
- What they receive
- Every request to the application, in transit
- Request metadata and operational logs
- Where
- United States
- Receiving data now
- Live service, Preview deployments
- Still holding data
- Live service, Preview deployments
- Their own subprocessors
- No publicly published subprocessor list was located as of 2026-09-09; their data processing addendum is at vercel.com/legal/dpa. Unverified, not absent.
Supabase
Supabase Inc. (US)Database hosting for all application data; sign-in, until our identity provider replaces it
- What they receive
- All application data: canon, sequences, shots, memory, references
- Sign-in identifiers, while they are the authoritative sign-in provider
- Where
- United States
- Receiving data now
- Live service, Preview deployments
- Still holding data
- Live service, Preview deployments
- Their own subprocessors
- Their list
Amazon Web Services
Amazon Web Services, Inc. (US)a subprocessor of SupabaseInfrastructure underneath Supabase
- What they receive
- Whatever Supabase stores, at rest
- Where
- United States
- Receiving data now
- Live service, Preview deployments
- Still holding data
- Live service, Preview deployments
- Their own subprocessors
- AWS is reached only through Supabase and appears on Supabase’s own subprocessor list. We do not enumerate AWS’s downstream processors.
WorkOS
WorkOS, Inc. (US)Sign-in and session management
- What they receive
- Email address and sign-in identifiers
- Authentication events and session metadata
- Where
- United States
- Receiving data now
- Preview deployments, Local development
- Still holding data
- Preview deployments (retention period not verified), Local development
- Their own subprocessors
- Their list
Cloudflare
Cloudflare, Inc. (US)Application hosting, database connection pooling, and planned media storage and generation compute
- What they receive
- Project content and database queries
- Authentication and request metadata
- Operational logs
- Generated and uploaded media bytes
- Reference material you supply
- Where
- Global network for application processing and database transit; planned media storage pinned to the US jurisdiction
- Receiving data now
- Preview deployments
- Still holding data
- Preview deployments (retention period not verified)
- Their own subprocessors
- Their list
Anthropic
Anthropic PBC (US)Text models used to plan and describe shots
- What they receive
- Prompt text assembled from your project’s canon, shot contract and memory
- Model output
- Where
- United States
- Receiving data now
- No — disclosed in advance of any data being sent
- Their own subprocessors
- Their trust centre is at trust.anthropic.com and is expected to carry a subprocessor list, but the URL could not be verified on 2026-09-09: the host answers 200 for any path, so reachability proves nothing. Unverified, not absent.
ElevenLabs
Eleven Labs Inc. (US)Video and audio generation
- What they receive
- Shot prompts and generation parameters
- Reference media you supply
- Generated video and audio
- Where
- United States / Netherlands / Singapore
- Receiving data now
- No — disclosed in advance of any data being sent
- Their own subprocessors
- Their terms describe the model operators behind this service as independent third parties, and reserve the right to substitute them at their sole discretion. No maintained list of those operators has been located: unverified, not empty. Identifying them is a condition of our sending anything to this vendor.
Stripe
Stripe (contracting entity must be verified for the billing account before activation)Hosted payments and subscription management
- What they receive
- Workspace billing identifier
- Selected price and subscription
- Payment status; payment details are entered directly in Stripe-hosted pages
- Where
- Account-dependent international processing; deployment-specific terms remain unverified
- Receiving data now
- No — disclosed in advance of any data being sent
- Their own subprocessors
- Stripe also acts as an independent controller for some payment activities. Review the account agreement, privacy policy and downstream processors before activation. https://stripe.com/privacy and https://stripe.com/legal/ssa
OpenAI
OpenAI (contracting entity must be verified for the API account before activation)Text generation through the Responses API
- What they receive
- Assembled prompt text
- Generated text
- Request and token usage metadata
- Where
- Account and project-dependent; processing region remains unverified
- Receiving data now
- No — disclosed in advance of any data being sent
- Their own subprocessors
- The Services Agreement and Data Processing Addendum were reviewed for this framework. No account-specific retention, regional processing or route clearance is asserted. https://openai.com/policies/services-agreement/ and https://openai.com/policies/data-processing-addendum/
Higgsfield
Higgsfield Inc. (US)Scene and generated B-roll video generation
- What they receive
- Shot prompts and model-specific generation parameters
- Reference images and other media explicitly selected by the creator
- Generated video and provider request metadata
- Where
- United States and other locations not verified per model/operator; the privacy policy says personal information is necessarily processed in the US and may also reach recipients elsewhere
- Receiving data now
- No — disclosed in advance of any data being sent
- Their own subprocessors
- Higgsfield’s current terms and privacy policy describe third-party model, GPU, cloud and compute providers, but no maintained downstream list or per-request effective-operator field has been verified. The actual model operator and processing region must be identified and cleared before this route opens. https://higgsfield.ai/terms-of-use-agreement and https://higgsfield.ai/privacy-policy