Authorized Sub-processors
A comprehensive, transparent directory of all third-party vendors and data processors that handle customer personal data on behalf of KreatorAI.
01Overview & GDPR Art. 28
KreatorAI Studio engages select third-party entities (“Sub-processors”) to provide critical cloud hosting, database management, generative AI computation, and payment processing services. Prior to onboarding any sub-processor, we conduct rigorous security, privacy, and technical assessments to ensure compliance with our Data Processing Agreement (DPA), Article 28 of the EU GDPR, and applicable global privacy laws.
Every sub-processor is contractually bound to process customer data solely in accordance with our instructions, maintain industry-standard security measures (SOC 2, ISO 27001), and never use creator inputs for foundation model training without explicit consent.
02Certified Sub-processors Directory
Below is our current list of approved sub-processors, organized by operational role.
03Hosting & Core Infrastructure
Entities providing cloud servers, databases, security, and identity verification:
| Sub-processor | Service Provided | Data Processed | Location | Safeguards |
|---|---|---|---|---|
| Google Cloud Platform Google LLC | Core cloud infrastructure, scalable compute clusters, and cloud storage. | Encrypted project backups, container workloads, network logs. | United States / Global | EU-US Data Privacy Framework, Standard Contractual Clauses (SCCs), ISO 27001 |
| Supabase Supabase Inc. | Managed PostgreSQL database, row-level security, media asset buckets. | User profile data, workspace membership, generation metadata, uploaded assets. | United States / EU (Frankfurt) | Standard Contractual Clauses (SCCs), SOC 2 Type II |
| Firebase Google LLC | Authentication, OAuth federated tokens (Google / Apple), push alerts. | Email address, display name, authenticated session tokens. | United States / Global | EU-US Data Privacy Framework, SOC 1/2/3, ISO 27001 |
04AI Models & Distributed Compute
Generative model inference providers. Prompts sent to these systems are executed under enterprise zero-retention commercial licenses:
| Sub-processor | Service Provided | Data Processed | Location | Safeguards |
|---|---|---|---|---|
| Google Gemini AI Google LLC | Large language models (Gemini 3.8/3.7/3.6 Flash) & Imagen 3 image generation. | Creator prompt text, script outlines, image generation prompts (zero training retention). | United States | Enterprise Commercial Data Protection Terms, ISO 27001 |
| Fal.ai Features Analytics Inc. | Distributed GPU inference for FLUX.1 image models, Wan 2.1, and Kling video generation. | Image and video generation prompts, reference visual frames. | United States | Standard Contractual Clauses (SCCs), X-AI-Data-Retention: none enforced |
| ElevenLabs ElevenLabs Inc. | Neural text-to-speech, synthetic voice generation, and automated video dubbing. | Script copy for voice synthesis, audio clips for authorized voice cloning. | United States / United Kingdom | Standard Contractual Clauses (SCCs), SOC 2 Type II |
| HeyGen Surreal Interactive Inc. | AI avatar animation, lip-sync rendering, and photorealistic video synthesis. | Authorized creator reference portrait footage and script audio tracks. | United States | Standard Contractual Clauses (SCCs), Enterprise Commercial Terms |
05Billing, Email & Telemetry
Service providers that power billing, transactional email notifications, and reliability telemetry:
| Sub-processor | Service Provided | Data Processed | Location | Safeguards |
|---|---|---|---|---|
| Stripe Stripe Inc. | Payment processing, subscription billing, fraud protection, and tax compliance. | Billing contact information, masked credit card details, payment history. | United States / European Union | PCI-DSS Level 1 Service Provider, EU-US Data Privacy Framework |
| Resend Resend Inc. | Transactional email delivery, email verification, and billing notifications. | Recipient email address, name, transactional message content. | United States | Standard Contractual Clauses (SCCs), SOC 2 Type II |
| Sentry Functional Software Inc. | Real-time error tracking, exception monitoring, and backend crash diagnostics. | Anonymized stack traces, route metadata (PII and auth headers strictly scrubbed). | United States | Standard Contractual Clauses (SCCs), SOC 2 Type II |
| PostHog PostHog Inc. | Privacy-first product analytics and aggregate user flow metrics. | Anonymized client events ($ip forced to 0.0.0.0; prompt text scrubbed). | United States / European Union | GDPR Compliant, Data Processing Addendum (DPA) |
06International Transfer Safeguards
Where personal data is transferred outside the European Economic Area (EEA), the United Kingdom, or Switzerland, KreatorAI ensures appropriate safeguards are in place in accordance with Chapter V of the GDPR. These safeguards include:
- EU-U.S. Data Privacy Framework: Participating sub-processors certified under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks.
- Standard Contractual Clauses (SCCs): Execution of the European Commission’s approved Standard Contractual Clauses (Module 3: Processor-to-Processor and Module 2: Controller-to-Processor) with all non-EEA vendors.
- Zero Model Retention: Mandatory contractual commitments and technical headers ensuring user content is not stored beyond active inference.
07Updates & Objection Rights
KreatorAI maintains an active notification mechanism for sub-processor updates:
- We provide at least 30 days advance notice before engaging any new sub-processor that processes customer personal data.
- Notices are published to this page and communicated via email to account owners who have executed a Data Processing Agreement.
- Customers may reasonably object to any new sub-processor on data protection grounds within 14 days of notice by contacting privacy@kreatoraistudio.com. If an objection cannot be mutually resolved, you have the right to terminate your subscription without penalty.
08Contact & Data Processing Agreement
To request an executed Data Processing Agreement (DPA) including Standard Contractual Clauses, or to subscribe to sub-processor update notifications, please contact our Data Protection Officer at:
KreatorAI Legal & Privacy Team
Email: privacy@kreatoraistudio.com
Data Protection Officer: dpo@kreatoraistudio.com