Subprocessors
Last updated November 9, 2026
Draft, under review. This text may change before it takes effect.
These companies process personal information for Vlick under written agreements that limit their use of it to providing their service to us. Business customers are told of changes as the Data Processing Addendum describes: write to hello@vlick.ai with the subject “Subprocessor updates” to receive notices by email.
Infrastructure
| Provider | What it does for Vlick | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting of the website and app (Workers, Durable Objects), file storage (R2), DNS, bot protection (Turnstile), website analytics, inbound email routing | All service data in transit; stored files | United States and Cloudflare’s global network |
| Supabase, Inc. (on Amazon Web Services) | Database | Account, workspace, billing and content records | United States (US East) |
| ZEROPLE USA INC (our own computers) | Rendering and job processing (not a third party) | Media and content being processed | United States |
AI and media generation
| Provider | What it does for Vlick | Data | Location |
|---|---|---|---|
| Anthropic, PBC | Claude models for the AI team (research, planning, writing, review) and Library descriptions | Briefs, scripts, workspace text, pictures and contact sheets of media | United States |
| Google LLC (Gemini API) | Image generation, Veo video generation, quality checks of rendered videos, Library descriptions | Prompts, reference images, frames, pictures of media | United States |
| ElevenLabs (Eleven Labs Inc.) | Voice-over | Script text | United States |
| Higgsfield AI | Video scene generation (Kling models) | Prompts and keyframe images | United States |
| OpenAI, L.L.C. | Image generation, only where enabled for a workspace | Prompts and reference images | United States |
If your workspace adds its own key or plan for an AI provider, that provider works for you under your account, not as our subprocessor.
Owner Confirm each AI vendor’s legal entity, data-processing terms (no training on API data, retention), and processing location; Higgsfield is used through a subscription login today and needs business/API terms before customers. Remove OpenAI if it is not used at launch.Payments, email and notifications
| Provider | What it does for Vlick | Data | Location |
|---|---|---|---|
| Stripe, Inc. | Payments, invoices, subscriptions, sales tax, fraud prevention | Name, email, billing address, payment details (held by Stripe), purchase history | United States |
| Resend | Sending email (sign-in codes, invitations, notices, support replies) | Email address, name, message content | United States |
| Apple Inc. | Sign in with Apple, push notifications to iPhone and Mac (APNs), App Store purchases | Account id, email, device token, notification text, purchase records | United States |
| Google LLC (Firebase Cloud Messaging, Google sign-in) | Push notifications to Android, Google sign-in | Device token, notification text; account id, email | United States |
| Microsoft Corporation | Microsoft sign-in | Account id, name, email | United States |
| ntfy (ntfy.sh) | Phone alerts to Vlick staff about service health | Short alert text (personal details removed) | Owner Confirm where ntfy.sh is hosted, or self-host ntfy / drop it for customer-facing alerts. |
Services you choose to connect
These receive data because you direct us to send it or to fetch it, and they act under their own terms, not as our subprocessors: YouTube and Google (publishing, analytics), Meta (Facebook, Instagram, Threads), TikTok, Google Drive and Google Photos, Microsoft OneDrive and SharePoint, Dropbox, and AI providers whose keys or plans you add.
Lawyer Check that the list and the “Location” column are accurate at launch and that a DPA is in place with each provider (most offer one online).
Data we use
Place names in the Library come from GeoNames (geonames.org), used under CC BY 4.0, on our own servers.