Subprocessors
List last changed September 22, 2026
Core infrastructure
Used for every request. These are what the product runs on.
application hosting and delivery
Request metadata and IP addresses. Serves the application and its pages.
authentication and database
Accounts, credentials (stored only as salted hashes), projects, comments, contacts, activity logs and application data.
file storage (R2), video encoding (Containers) and website analytics
Uploaded files and their metadata; hosts and transcodes video for playback. Processes request metadata and IP addresses at the network edge. On our public marketing pages only, records anonymous, cookieless visit counts — never on a review portal or inside the app.
payments and subscriptions
Subscription payments, and — through Stripe Connect — client payments made directly to a creator. Billing contact details and payment method data, which we never see in full.Stripe acts as an independent controller for the payment data it handles, not solely as our processor.
transactional email
Recipient names, email addresses, message contents and delivery metadata for invitations, notifications, invoices and account email.
| Subprocessor | Purpose | Data processed | Established in |
|---|---|---|---|
| Vercel | application hosting and delivery | Request metadata and IP addresses. Serves the application and its pages. | United States |
| Supabase | authentication and database | Accounts, credentials (stored only as salted hashes), projects, comments, contacts, activity logs and application data. | United States |
| Cloudflare | file storage (R2), video encoding (Containers) and website analytics | Uploaded files and their metadata; hosts and transcodes video for playback. Processes request metadata and IP addresses at the network edge. On our public marketing pages only, records anonymous, cookieless visit counts — never on a review portal or inside the app. | United States |
| Stripe | payments and subscriptions | Subscription payments, and — through Stripe Connect — client payments made directly to a creator. Billing contact details and payment method data, which we never see in full.Stripe acts as an independent controller for the payment data it handles, not solely as our processor. | United States |
| Resend | transactional email | Recipient names, email addresses, message contents and delivery metadata for invitations, notifications, invoices and account email. | United States |
Used in specific circumstances
Reached only in the situations described, rather than on every request.
product analytics
On our public marketing pages and on a signed-in creator’s own pages: pages visited, actions taken and a recording of the session, together with the account identifier of a signed-in creator. No cookie is set. Never active on a client review portal, so a client opening a shared link is not measured or recorded.
stock image search
Only when a creator searches for stock imagery inside the app. The search terms reach the provider; account information does not.
stock media search
Only when a creator searches for stock media inside the app. The search terms reach the provider; account information does not.
typefaces
Your browser requests font files directly from Google, which discloses your IP address and user agent to Google. No cookie is set by that request.Loaded by the browser rather than by our servers, so Google receives the request directly. Listed for completeness.
| Subprocessor | Purpose | Data processed | Established in |
|---|---|---|---|
| PostHog | product analytics | On our public marketing pages and on a signed-in creator’s own pages: pages visited, actions taken and a recording of the session, together with the account identifier of a signed-in creator. No cookie is set. Never active on a client review portal, so a client opening a shared link is not measured or recorded. | United States |
| Unsplash | stock image search | Only when a creator searches for stock imagery inside the app. The search terms reach the provider; account information does not. | Canada |
| Pexels | stock media search | Only when a creator searches for stock media inside the app. The search terms reach the provider; account information does not. | Germany |
| Google Fonts | typefaces | Your browser requests font files directly from Google, which discloses your IP address and user agent to Google. No cookie is set by that request.Loaded by the browser rather than by our servers, so Google receives the request directly. Listed for completeness. | United States |
Notice of changes
We will post any addition to this list here, and give existing customers at least 30 days’ notice by email before a new subprocessor begins processing personal data — so that anyone who needs to object has the chance to before it happens.
To be notified of changes, email privacy@filesaurus.com with “Subprocessor updates” in the subject and we will add you to the notification list.
How this fits the rest of our terms
- What each vendor receives and why — this page, plus Privacy Policy §7, which renders the same list.
- Where data is processed, and the transfer safeguards — international transfers rely on the European Commission’s Standard Contractual Clauses; Privacy Policy §10. The Established in column below is where each company is incorporated, not a claim about which data centre holds a particular file.
- How long data is kept — Privacy Policy §9.
- The controls protecting it — Security.
- A data processing addendum (GDPR Art. 28) — available on request from privacy@filesaurus.com.