Sub-processors
This version took effect on 17 August 2026.
1. What a sub-processor is
Where we process personal data on your instructions, we are a processor and you are the controller. A sub-processor is a company we engage to help with that processing. The list in section 2 is complete as of the date at the top of this page.
The social networks you connect are deliberately not on it. They are not acting on our instructions: you have your own account and your own agreement with each of them, and we send them what you told us to publish. The privacy policy describes that relationship separately.
2. The list
| Company | What it does, and what it sees | Where |
|---|---|---|
| SupabaseTheir terms | The database, the file storage and the authentication system.Everything the service stores: your account, your workspaces, your posts and media, the figures collected for you, and the encrypted connection secrets. | Ireland (eu-west-1) |
| VercelTheir terms | Application hosting. Every request to the service passes through it.Requests in transit, plus ordinary server logs: IP address, user agent, the URL requested and the time. | Dublin (dub1) |
| AnthropicTheir terms | Generating and rewriting text: captions, drafts and suggested replies.The material you send to a text feature at the moment you use it, which is your brief, your brand description and any post or comment you asked it to work from. | United States |
| OpenAITheir terms | Generating images.The prompt you give an image feature at the moment you use it. | United States |
| StripeTheir terms | Taking payment and holding the subscription.Your billing details, which you enter on Stripe’s own hosted fields. Card numbers never reach us and are never stored by us. | United States |
| ResendTheir terms | Sending the emails the service sends you, which today are workspace invitations.The recipient address, the message, and whether it was delivered. | United States |
3. Transfers out of the EEA
Everything we store ourselves is stored in the European Union: the database, your uploaded files and the authentication records are in Ireland, and the application runs in Dublin.
Four of the six are United States companies, and the data described against each of them in section 2 is handled there. Where personal data covered by UK or EU law is transferred out of that area, the transfer relies on the mechanisms in that provider’s own data processing terms, including the Standard Contractual Clauses where they apply. Each provider’s terms are linked in the table.
4. Changes, and your right to object
Before a new sub-processor begins processing your data, we will give you at least 30 days’ notice, by email to the address on the workspace owner’s account and by updating this page. If you object on reasonable data protection grounds within that period, write to us and we will either find another way to deliver that part of the service or, if we cannot, let you end your subscription without penalty for the remainder of the term.
Replacing a sub-processor with another doing the same job counts as a new one for this purpose. Removing one does not, and needs no notice.
5. Contact
Questions, objections and requests for a signed copy of the data processing agreement all go to hello@crestnote.com.