Data protection
Subprocessors
Every third party that processes personal data on our behalf, what it receives, and where it runs.
This list forms part of our Privacy Policy. It is compiled from the running system rather than from our own documentation, and we update it before adding a new subprocessor that processes personal data.
1. Infrastructure
| Provider | Role | Personal data it receives | Location |
|---|---|---|---|
| Supabase | Database, authentication, file storage, edge functions | All account, profile, workspace, content, brand kit, upload, token and ledger data | Ireland (EU) |
| Vercel | Application hosting and edge network | IP address, user agent, request logs | Global edge network |
| Fly.io | Video processing worker host | Video source media, job metadata | London, United Kingdom |
2. AI model providers
These receive prompt text, brand kit content, and reference or source media needed to produce Output.
| Provider | Role | What it receives |
|---|---|---|
| Anthropic (Claude) | Primary text generation — captions, plans, briefs, titles | Prompts, brand kit text, post content |
| Groq | Fallback text generation | The same, when the primary provider fails |
| fal.ai | Image generation, image editing, upscaling, video generation | Prompts, reference and uploaded images, source video |
3. Training and retention posture
Verified against each provider’s published terms on 25 August 2026. We state each position separately rather than making one blanket promise, because we can only pass on what each provider actually commits to.
| Provider | Trains on your inputs? | Retention |
|---|---|---|
| Anthropic | No — the Commercial Services Agreement prohibits training on API inputs and outputs | Deleted within 30 days; up to 2 years if flagged for a usage-policy violation. Zero-retention available to qualifying accounts |
| Groq | No — contractually prohibited from using inputs or outputs for training or fine-tuning | No retention of inference inputs and outputs by default; troubleshooting logs up to 30 days, opt-out available in Data Controls |
| fal.ai | Unknown — its privacy policy is silent on model training, and we have not obtained written confirmation | Generated media held on fal.ai’s CDN for a minimum of 7 days |
The fal.ai position is a genuine gap, and we are not going to paper over it. fal.ai receives the most sensitive material in the product — uploaded reference images, brand assets, and source video. Until we obtain written confirmation of its training posture, you should not assume any training restriction applies to material sent to the image, video, editing or upscaling features. We will update this page and the Privacy Policy when that changes, in either direction.
4. Publishing
| Provider | Role | What it receives |
|---|---|---|
| Zernio | Social publishing API — connects accounts and delivers posts to platforms | Connected account authorisation, post text, media, scheduling metadata |
Platforms reachable through this provider: Facebook, Instagram, LinkedIn, Pinterest, Threads, TikTok, X and YouTube. Each platform is itself an independent controller of what you publish to it, under its own terms — see Terms section 11.
5. Operations
| Provider | Role | What it receives |
|---|---|---|
| Resend | Transactional email | Email address, message content |
| Sentry | Error monitoring and performance tracing | Stack traces, breadcrumbs, request context, user identifiers |
| Paystack | Payment processing and billing | Card details (direct to the processor), billing address, transaction records. Not yet active — billing is not open to users, and no payment has been taken. This page will name the processor in use before any payment is processed |
6. What is not here
Verified absent from the codebase, because what we do not run is as much a part of this disclosure as what we do:
- No analytics or product-telemetry provider. No PostHog, Mixpanel, Google Analytics or Plausible anywhere in the application.
- No advertising or marketing-attribution pixel.
- No session-replay tool.
- No CRM or customer-messaging widget.
If any of these is added, this page and the Privacy Policy cookie section are updated in the same change.
7. Third-party media retrieval
The video pipeline retrieves media from URLs you supply. This is not a subprocessor relationship: no personal data of yours is sent to the source site beyond the request itself. It is a terms-of-service and copyright exposure instead, and it is addressed in Terms of Service section 8 and Acceptable Use Policy section 4.
8. Changes to this list
We update this page before a new subprocessor begins processing personal data, and whenever an existing one’s role, location or retention position changes. Questions about anything on it go to privacy@brandosse.com.
The rest of the agreement