Sub-processors
These are the third parties that process data on ReadyForm's behalf. We update this page before a new sub-processor goes live, as required by our DPA. Questions: info@theaiagency.ae.
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Supabase | Authentication and database | Email, hashed password, account metadata, edit data | EU — Frankfurt, Germany |
| Hetzner | Object storage and backend hosting | Uploaded video, renders, transcripts | EU — Germany / Finland |
| Vercel | Frontend hosting | Request metadata (IP, user agent) | EU — Frankfurt region |
| RunPod | GPU render workers | Video frames and transcripts during a render | EU — Iceland |
| Upstash | Rate limiting | Hashed request identifiers (IP, user id) | EU — Frankfurt, Germany |
| Resend | Transactional email (trial and account notifications) | Email address, first name, subscription plan and price | EU — Ireland |
| Sentry | Error monitoring | Stack traces, user id (never email or video content) | EU |
| PostHog | Product analytics and session recordings | Usage events — only after you opt in | EU |
| Anthropic | AI editing decisions (which takes to keep, captions, structure) | Transcript text and low-resolution thumbnails. Never your raw video or audio, and never used to train models. | United StatesEU Standard Contractual Clauses |
| Google (Drive import, optional) | Importing your own footage from Google Drive | Only the files you pick in the Drive picker | United StatesEU Standard Contractual Clauses — used only when you start an import |
| Pexels | Stock b-roll search | Search terms only — no personal data | United StatesNo personal data is transferred |
Transfers outside the EEA
Your account data, uploaded video, transcripts and renders are stored in the EU. Transcription and speaker detection run on our own EU hardware — no US audio service ever receives your recording. Three sub-processors sit in the United States, each limited to a narrow slice: Anthropic receives transcript text and low-resolution thumbnails to make the editing decisions, Google Drive receives only the files you choose to import, and Pexels receives search terms with no personal data attached. Those transfers rely on the EU Standard Contractual Clauses. Your raw video and audio never leave the EU.
Changes
We will update this page when a sub-processor is added or replaced. If you object to a new sub-processor, email us — the DPA sets out how objections are handled.
Last updated: 23 August 2026.