Legal

Sub-processors

Last updated: July 21, 2026

In accordance with GDPR Article 28(2), this page lists third-party services that may process personal data on behalf of PrismPoster.

Data controller

PrismLabs OÜ
Sepapaja tn 6, 15551 Tallinn, Harju County
Estonia

Email: dpo@prismposter.com

Data processing agreements

We maintain data processing terms with providers that process personal data for PrismPoster. OAuth providers, connected streaming platforms, and payment networks may also act as independent controllers when you sign in with, connect, or pay through those services.

When a creator opts a track into PrismRadio broadcast, PrismRadio simulcasts that public track (with its public usertag and cover art) to YouTube Live and Twitch, which act as independent controllers for their own viewers and may run their own advertising.

If you connect your Discord account, we send your Discord user ID to Discord to assign plan-based community roles. When you publish a creation publicly, it may also be shared to our Discord community showcase channel with your public usertag; you can turn this off in Settings. Discord acts as an independent controller for its own service.

Essential services

Required for basic functionality

Stripe

Privacy DPA

Payment processing and subscription management

Data processed

Email address
billing information
payment card details
transaction history

LocationUnited States (EU-US Data Privacy Framework)

Legal basisContract performance

RetentionAs required by financial-record law, typically 7 years from last transaction or account closure.

PayPal

Privacy

Partner-program commission payouts

Data processed

Name on the recipient account
PayPal email address
payout amount and reference

LocationLuxembourg (PayPal (Europe) S.à r.l. et Cie, S.C.A.)

Legal basisContract performance

RetentionAs required by payment-services and financial-record law, typically 5-7 years from the transfer.

Resend

Privacy

Transactional email delivery

Data processed

Email address
name
email content

LocationUnited States

Legal basisContract performance

RetentionDelivery logs: 30 days. Email content: not retained after send.

AI processing

Powers content generation features

Google (Gemini / Google Cloud AI)

Privacy DPA

AI image, video, and audio generation and prompt processing

Data processed

Prompts and reference media you submit
Generated output
Creator Cast face frames and portrait likeness, processed transiently per request

LocationUnited States / European Union

Legal basisContract performance; explicit consent (Art. 9(2)(a)) for biometric processing

RetentionTransient per-request processing.

BytePlus (ByteDance ModelArk)

Privacy DPA

AI video generation, plus liveness verification and portrait-likeness storage for Creator Cast owners who opt in

Data processed

Prompts, reference media, and generated video
Biometric facial-geometry data from the liveness face scan
Portrait photographs of your likeness, stored while your verified identity is active

LocationSingapore / Global — outside the EEA, under EU Standard Contractual Clauses

Legal basisExplicit consent (Art. 9(2)(a)) for biometric data; Art. 46 safeguards for the transfer

RetentionDeleted when you revoke your verified identity or request erasure.

SunoAPI.org

Privacy

AI music generation

Data processed

Music prompts and lyrics inputs
Audio you upload to create a cover or extend a track, including any voice recording it contains
Generated audio and metadata

LocationUnited States / Global

Legal basisContract performance

RetentionPer service terms and abuse-monitoring retention.

Musixmatch

Privacy

Lyrics rights-safety screening before music generation

Data processed

Short lyric excerpts used as search queries

LocationEuropean Union (Italy) / Global

Legal basisContract performance

RetentionTransient per-request processing.

Infrastructure

Hosting and technical operations

Fly.io

Privacy

Media rendering and live-stream broadcasting infrastructure

Data processed

Generated media
stream metadata
viewer connection metadata

LocationEuropean Union (Frankfurt) / Global

Legal basisContract performance

RetentionTransient processing for rendering and broadcast.

Supabase

Privacy DPA

Database hosting and data storage

Data processed

All stored user data
account information
content history

LocationEuropean Union (Ireland); Supabase Inc. (US) as provider with support access under DPA

Legal basisContract performance

RetentionUntil account deletion, with backups purged on normal backup rotation. Tier-based content-history retention may apply within the account.

Vercel

Privacy DPA

Website hosting, CDN, serverless functions, and cookieless web analytics

Data processed

IP address, request metadata, performance metrics
Cookieless aggregated web-analytics events (page views, referrer, country, device)

LocationGlobal edge network

Legal basisLegitimate interest

RetentionAccess logs: 30 days rolling. Aggregated performance and web-analytics metrics: 90 days.

Upstash

Privacy DPA

Redis cache, rate limiting, abuse prevention, and queue coordination

Data processed

Pseudonymous rate-limit keys
request counters
job/cache metadata

LocationUnited States / European Union / Global

Legal basisLegitimate interest

RetentionShort-lived cache and rate-limit records expire according to each key TTL.

Sentry

Privacy DPA

Error monitoring and crash reporting

Data processed

Error context (sanitized)
stack traces
browser/device info

LocationEuropean Union (Germany — EU data residency); Sentry, Inc. (US) as provider

Legal basisLegitimate interest

RetentionError events: 90 days rolling. Attachments: 30 days. PII is scrubbed in-flight where configured.

Storage and delivery

Stores and delivers user media assets

Cloudflare R2

Privacy DPA

Object storage, media delivery, and CDN-backed asset access

Data processed

Uploaded and generated media
Object and request metadata
Creator Cast portrait images (special-category likeness) for owners who opt in

LocationGlobal

Legal basisContract performance; explicit consent (Art. 9(2)(a)) for stored portrait likeness

RetentionRetained while the account or asset is active. Portrait images are deleted on revoke or a verified erasure request.

Analytics

Helps improve our service when consented

PostHog

Privacy DPA

Product analytics and user behavior tracking

Data processed

Usage events
feature interactions
session recordings if consented

LocationEuropean Union

Legal basisConsent (browser analytics) / Legitimate interest (server-side operational and security events)

RetentionEvents follow project retention settings. Session recordings are disabled unless analytics consent is present.

Google Analytics (GA4)

Privacy DPA

Website and product analytics

Data processed

Page views and interaction events
IP address (truncated), device and referrer data
Analytics cookie identifiers

LocationUnited States / Global

Legal basisConsent — loads only after Analytics consent (Google Consent Mode v2)

RetentionPer configured GA4 data-retention window.

Changes to sub-processors

We may update this list when we add or remove sub-processors. Material changes will be communicated when required by applicable law or contract.

For questions about data processing practices or to exercise privacy rights, contact dpo@prismposter.com.

Full details on how we handle your data

Privacy Choices

Opt out and manage privacy signals

Cookie Policy

Information about cookies we use

Data processing agreements