Legal

Sub-processors

Last updated: October 16, 2026

In accordance with GDPR Article 28(2), this page lists third-party services that may process personal data on behalf of PrismPoster.

Data controller

PrismLabs OÜ
Sepapaja tn 6, 15551 Tallinn, Harju County
Estonia

Email: dpo@prismposter.com

Data processing agreements

We maintain data processing terms with providers that process personal data for PrismPoster. OAuth providers, connected streaming platforms, and payment networks may also act as independent controllers when you sign in with, connect, or pay through those services. In particular, Stripe acts as merchant of record for checkout purchases (subscriptions and credit packs) and processes the related billing data as an independent controller for that role, under its own privacy policy. Credits bought inside the PrismPoster iOS or Android app are sold through the Apple App Store or Google Play, which act as the seller and process that purchase as independent controllers under their own privacy policies; we receive only the transaction details needed to add the credits to your account. If you allow Marketing cookies, the Google Ads tag sends Google Ireland Limited visit data so we can measure our ad campaigns; Google acts as an independent controller for that data under its own privacy policy.

If you connect your Discord account, we send your Discord user ID to Discord to assign plan-based community roles. When you publish a creation publicly, it may also be shared to our Discord community showcase channel with your public usertag; you can turn this off in Settings. Discord acts as an independent controller for its own service.

Essential services

Required for basic functionality

Stripe

Privacy DPA

Payment processing and subscription management. For checkout purchases Stripe also acts as merchant of record, handling transaction taxes and payment disputes as an independent controller for that role

Data processed

Email address
billing information
payment card details
transaction history

LocationUnited States (EU-US Data Privacy Framework)

Legal basisContract performance

RetentionAs required by financial-record law, typically 7 years from last transaction or account closure.

Zoho

Privacy

Business email hosting for our support, privacy, and security mailboxes

Data processed

Name and email address of people who write to us
Content of support, privacy, and security correspondence

LocationEuropean Union (Zoho EU data centres)

Legal basisLegitimate interest (handling correspondence you send us)

RetentionRetained as ordinary business correspondence while the matter is open or required.

Resend

Privacy

Transactional email delivery

Data processed

Email address
name
email content

LocationUnited States

Legal basisContract performance

RetentionDelivery logs: 30 days. Email content: not retained after send.

Google Firebase Cloud Messaging

Privacy DPA

Push notifications to the PrismPoster iOS and Android apps, telling you when a render you started has finished or failed. On iPhone, Firebase passes the notification to Apple Push Notification service, which delivers it to your device

Data processed

The push token your device issues for the PrismPoster app
A minimal data-only message: the kind of result, whether it finished or failed, and the item id to open. No prompts, media, names or email addresses

LocationGoogle's global infrastructure; may be processed outside the EEA under the Firebase Data Processing and Security Terms

Legal basisContract performance. You can turn notifications off at any time in your device settings. Transfers outside the EEA rely on the EU Standard Contractual Clauses in the Firebase Data Processing and Security Terms.

RetentionWe keep a push token until the app removes it when you sign out, or until you delete your account; a token the push service reports as no longer valid is never used again. Delivery data Firebase keeps is held under Google's Firebase terms.

Your browser's push service

Privacy

Browser notifications, only after you turn them on: when a video or song you started is ready, and before free starter credits expire. The push service is chosen by your browser, not by us: Google Firebase Cloud Messaging for Chrome and most other Chromium browsers, Mozilla for Firefox, Apple for Safari and Microsoft for Edge on Windows

Data processed

The push address your browser issues for prismposter.com
The notification itself, encrypted so that only your browser can read it; the push service sees when it was sent, not what it says

LocationThe push service's own infrastructure, which may be outside the EEA

Legal basisConsent, given in your browser when you turn notifications on. You can withdraw it at any time in Settings, or in your browser’s site settings.

RetentionWe keep the push address until you turn notifications off, your browser withdraws it, or you delete your account. A push address the push service reports as no longer valid is deleted.

Google reCAPTCHA

Privacy

Protecting email sign-up from bots and automated abuse

Data processed

IP address
Browser and device information and interaction signals on the sign-up form

LocationUnited States / Global

Legal basisLegitimate interest (preventing fraud and automated sign-ups)

RetentionPer Google's reCAPTCHA terms; we keep only the resulting score with the sign-up check.

AI processing

Powers content generation features

Google Cloud (Vertex AI)

Privacy DPA

AI image and video generation, text-to-speech voiceovers, prompt processing, and safety screening of the prompts and media you submit

Data processed

Prompts (including prompt text as you type it, to suggest matching settings) and the images and video you submit or reference
Portrait photos of your verified likeness, only when you generate a video of yourself on the standard video engine
Text you ask to have read aloud, and the speech generated from it
Generated images and video

LocationEuropean Union for image and text processing; video and speech generation run on Google's global infrastructure and may be processed outside the EEA

Legal basisContract performance; legitimate interest for safety screening; your explicit consent (GDPR Art. 9(2)(a)) for your verified-likeness photos. Transfers outside the EEA rely on the safeguards in the Google Cloud Data Processing Addendum.

RetentionProcessed to produce each result; finished outputs are copied to our own storage. Any copy the provider keeps is held under Google Cloud's service terms.

BytePlus (ModelArk)

Privacy DPA

AI image generation and editing, premium AI video generation, and verifying and storing your verified likeness if you choose to set one up

Data processed

Prompts, reference images and video, and generated images and video
If you set up a verified likeness: the live face check you complete on the provider's page and the portrait photos you add (biometric data)

LocationSingapore / Global — outside the EEA, under EU Standard Contractual Clauses. A verified likeness is stored in Singapore.

Legal basisGeneration: contract performance. Verified likeness: your explicit consent (GDPR Art. 9(2)(a)). Transfers rely on EU Standard Contractual Clauses (Art. 46); for a verified likeness you also explicitly agree to the transfer before the face check starts.

RetentionGeneration requests are processed per request and retained under the provider's service terms. A verified likeness is erased at the provider six hours after you set it up, or sooner when you delete it or your account.

Sociaro Baltic OÜ (model gateway)

Privacy

Routing Premium AI video renders that show one or more real people, after you confirm the permission of everyone shown, to the video model and delivering the result

Data processed

Prompts, reference images and video sent for that render, and the generated video
An account identifier for spend attribution; never your name or email

LocationGateway and database in Helsinki, Finland; the model behind a render runs with its own provider (ByteDance/BytePlus for the video models we use), outside the EEA under EU Standard Contractual Clauses

Legal basisContract performance. Pictures and clips of real people are sent only after you confirm that you hold the permission of everyone shown (recorded under our Terms, Section 2.2). Transfers rely on EU Standard Contractual Clauses (Art. 46).

RetentionPrompts and reference pictures are handled transiently for routing and are not written to the gateway database as request content; the generated clip is copied to our own storage once it is ready. Request metadata is retained by the gateway for accounting.

ElevenLabs

Privacy

AI sound-effect and speech generation in the editor

Data processed

The text descriptions and scripts you submit
Generated audio

LocationUnited States / Global

Legal basisContract performance

RetentionProcessed per request; retained under the provider's service terms.

SunoAPI.org

Privacy

AI music generation

Data processed

Music prompts and lyrics inputs
Audio you upload to create a cover or extend a track, including any voice recording it contains
Generated audio and metadata

LocationUnited States / Global

Legal basisContract performance

RetentionGenerated audio files are deleted by the provider 14 days after generation; request logs after 2 months. The recordings we store for a custom voice are deleted six hours after you create it; what the provider keeps of the voice is governed by its service terms. The provider is licensed only to operate its service and does not receive training rights.

Musixmatch

Privacy

Lyrics rights-safety screening before music generation

Data processed

Short lyric excerpts used as search queries

LocationEuropean Union (Italy) / Global

Legal basisContract performance

RetentionTransient per-request processing.

Anthropic

Privacy DPA

Writing the full music video you order for a song you have kept

Data processed

The song's title, style and lyrics, with the timing of each word
Numbers measured from the song's audio (tempo, beats and loudness); never the audio itself, your name, your email or any account identifier
Still frames of the film while it is being written, so it can be checked

LocationUnited States, under EU Standard Contractual Clauses

Legal basisContract performance. Transfers rely on EU Standard Contractual Clauses (Art. 46) in the provider’s data processing addendum.

RetentionProcessed per request to write the film, which is rendered on our own servers; retained by the provider under its commercial terms, which do not permit training its models on this data.

Infrastructure

Hosting and technical operations

Amazon Web Services (EC2)

Privacy

Media rendering infrastructure

Data processed

Uploaded and generated media sent for rendering, export or captioning

LocationEuropean Union (Frankfurt, eu-central-1)

Legal basisContract performance

RetentionTransient processing for rendering; no customer media is retained on the instance after a job completes.

Fly.io

Privacy

Backup media-processing capacity for video exports, captions, AI labels and content credentials when our primary render servers are unavailable

Data processed

Uploaded and generated media sent for rendering, export, watermarking or captioning, including any faces and voices it contains
Editor timeline projects and render job metadata

LocationEuropean Union (Frankfurt); Fly.io, Inc. (United States) as provider

Legal basisContract performance

RetentionTransient processing; no customer media is retained on the server after a job completes.

Supabase

Privacy DPA

Database hosting and data storage

Data processed

All stored user data
account information
content history

LocationEuropean Union (Ireland); Supabase Inc. (US) as provider with support access under DPA

Legal basisContract performance

RetentionUntil account deletion, with backups purged on normal backup rotation. Records that point at your uploads, a verified likeness and a custom voice are deleted six hours after the upload or setup. Tier-based content-history retention may apply within the account.

Vercel

Privacy DPA

Website hosting, CDN, and serverless functions

Data processed

IP address, request metadata, performance metrics

LocationGlobal edge network

Legal basisLegitimate interest

RetentionAccess logs: 30 days rolling.

Upstash

Privacy DPA

Redis cache, rate limiting, abuse prevention, and queue coordination

Data processed

Pseudonymous rate-limit keys
request counters
job/cache metadata

LocationUnited States / European Union / Global

Legal basisLegitimate interest

RetentionShort-lived cache and rate-limit records expire according to each key TTL.

Sentry

Privacy DPA

Error monitoring and crash reporting

Data processed

Error context and warning/error log lines, with email addresses, IP addresses and credentials removed
stack traces
browser/device info

LocationEuropean Union (Germany — EU data residency); Sentry, Inc. (US) as provider

Legal basisLegitimate interest

RetentionError events: 90 days rolling. Attachments: 30 days. PII is scrubbed in-flight where configured.

Google Fonts

Privacy

Font delivery for fonts you pick in the editor

Data processed

IP address and requested font files when the editor loads a font from Google servers

LocationUnited States / Global

Legal basisLegitimate interest (delivering a font you selected)

RetentionPer Google Fonts privacy disclosures; requests are not tied to a Google account.

Storage and delivery

Stores and delivers user media assets

Cloudflare R2

Privacy DPA

Object storage, encrypted database backups, media delivery, and CDN-backed asset access

Data processed

Uploaded and generated media
Encrypted database backups
Object and request metadata

LocationEurope (primary storage; not restricted to the EU) / Global (content-delivery network)

Legal basisContract performance

RetentionFiles you upload as inputs are deleted six hours after upload; media in a video-editor project and what you generate are retained until you delete them or your account. Backup copies of media are kept separately and erased once the original has been gone for 30 days, or sooner on request; uploaded inputs and likeness verification photos are never backed up.

Analytics

Helps improve our service when consented

PostHog

Privacy DPA

Product analytics and user behavior tracking

Data processed

Usage events
feature interactions
session recordings if consented

LocationEuropean Union

Legal basisConsent (browser analytics) / Legitimate interest (server-side operational and security events)

RetentionEvents follow project retention settings. Session recordings are disabled unless analytics consent is present.

Google Analytics (GA4)

Privacy DPA

Website and product analytics

Data processed

Page views and interaction events
IP address (truncated), device and referrer data
Analytics cookie identifiers
Account events sent from our servers (such as sign-up, purchase and generation), keyed to a one-way hashed account ID, only for accounts that granted Analytics consent

LocationUnited States / Global

Legal basisConsent — loads only after Analytics consent (Google Consent Mode v2)

RetentionPer configured GA4 data-retention window.

Changes to sub-processors

We may update this list when we add or remove sub-processors. Material changes will be communicated when required by applicable law or contract.

For questions about data processing practices or to exercise privacy rights, contact dpo@prismposter.com.

Full details on how we handle your data

Privacy Choices

Opt out and manage privacy signals

Cookie Policy

Information about cookies we use