Skip to content
CreatorBaseBack to CreatorBase

Sub-processors

Effective EFFECTIVE_DATE · Last updated LAST_UPDATED

Draft — not yet in force. These documents are a working draft. Company details are not filled in and they have not been reviewed by a lawyer, so they do not yet bind anyone. CreatorBase is invite-only and free during this period. If you need the finalised terms before using it, ask us.

In short

These are the companies we rely on to run CreatorBase. Each one only gets the data its job requires.

This summary is for orientation only. The numbered sections below are the actual terms.

1.How to read this

Under GDPR Art. 28 we have to tell you who else processes your data and give you a chance to object before we add anyone. This page is that list, and it is the authoritative one — our DPA points here rather than duplicating it.

A provider appears here only if it can process customer data. Tools we use that never touch it — accounting, our own code editor — are out of scope.

2.Infrastructure

ProviderWhat it doesData it can seeLocation
SupabaseDatabase, authentication, file storageEverything stored: account, brands, content, conversations, metrics, encrypted connector keysUnited States
VercelApplication hosting, and the gateway that routes AI requestsRequest data in transit, server logs, and prompt content passing through the gatewayUnited States

3.AI providers

These receive prompt content — which includes your brand details, voice samples, and the content being worked on — and return generated output.

ProviderWhat it doesData it can seeLocation
AnthropicThe assistant itself — reasoning, tool use, draftingConversation content and the context sent with itUnited States
OpenAIDrafting, image generation, embeddings, and dictation transcriptionContent sent for those operations, and dictated audioUnited States
xAIRealtime voice conversationLive audio, streamed directly from your browser to them — it does not pass through our serversUnited States

We use business tiers and settings intended to prevent your content being used to train these providers' models, and we do not consent to such use. We cannot independently audit them, so this is a statement about what we have contracted for.

4.Publishing, research and data

ProviderWhat it doesData it can seeLocation
PostizPublishing to your connected social platformsThe posts you publish, their media, and the analytics it returnsSee provider terms
ApifyRetrieving public posts and profiles you ask to analyseThe accounts and URLs you submit; returns public post dataUnited States / European Union
Google (YouTube Data API)Your YouTube channel metrics, video metadata and transcriptsThe channel you connect and its public dataUnited States

5.Communications

ProviderWhat it doesData it can seeLocation
ResendSending sign-in links, digests and product emailYour email address and the contents of messages we send youUnited States

6.International transfers

Most of these providers are in the United States. For personal data originating in the UK or EEA we rely on the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum where the UK GDPR applies.

7.Changes to this list

We will update this page before a new sub-processor starts processing customer data, and email account holders at least 30 days before it takes effect. If you object on reasonable data-protection grounds, write to [PRIVACY_EMAIL](mailto:PRIVACY_EMAIL) and we will either find an alternative or let you terminate without penalty.

Last reviewed: LAST_UPDATED.

Other documents