The third-party services Svmmon shares Customer data with, as required by GDPR Article 28(2). This list is referenced by the Data Processing Addendum.
We notify Customers of new sub-processors at least 30 days before they begin processing Customer data. If you want email notifications of changes, email support@svmmonapp.com and we will add you to the notification list.
Core infrastructure (mandatory)
These run the product. Without them, Svmmon does not function.
Stripe, Inc.
Purpose: Payment processing, subscription management, tax calculation, invoice generation.
Data: Email, name, billing address, tax ID (if provided), card data (never seen by Svmmon; collected directly by Stripe), subscription state.
Location: United States (with EEA infrastructure for EU customers).
Supabase, Inc.
Purpose: Database hosting, file storage, authentication.
Data: All Customer-uploaded content, account email, hashed credentials, generated slideshow metadata, performance logs.
Location: AWS US-East-1 (primary). Region pinned by the Customer's assigned project.
Vercel, Inc.
Purpose: Application hosting, edge functions, CDN.
Data: In-flight HTTP requests, IP addresses, user-agent strings, performance telemetry. No persistent storage of Customer data.
Location: Global edge network; serverless functions run in iad1 (US East).
Anthropic, PBC
Purpose: AI text generation for hooks, slide content, captions, analysis.
Data: Profile and prompt content the Customer chooses to generate from. Per Anthropic's data-handling terms, inputs are not used to train models.
Location: United States.
Railway Corp.
Purpose: Background worker hosting. Runs long jobs (such as TikTok-recreation scraping/rendering) that can't finish inside the app's serverless time limit.
Data: In-flight job payloads keyed by user ID: the source URLs/content a Customer chooses to recreate and the resulting slide images written to storage.
Location: United States.
Connected social platforms (Customer opt-in)
Only invoked when a Customer explicitly connects their account via OAuth. Instagram and YouTube posting are coming soon and not yet live. TikTok is the only platform Svmmon posts to today.
TikTok / ByteDance
Purpose: OAuth + posting to the Customer's linked TikTok account. Only when the Customer connects an account.
Data: OAuth tokens, posted content (slideshows).
Location: United States / Singapore / Ireland.
Meta Platforms (Instagram Graph API)
Purpose: Coming soon. Planned OAuth + posting to the Customer's linked Instagram account. Not yet live; no Customer data flows to Meta today.
Data: None yet. Will be OAuth tokens and posted content once this integration ships.
Location: United States / Ireland.
Google LLC (YouTube Data API)
Purpose: YouTube research queries today. Posting to the Customer's linked YouTube account is coming soon and not yet live.
Data: Research queries. Posted content will be added once posting ships.
Location: United States / Ireland.
Telegram Messenger Inc.
Purpose: Operational notifications to Customer's Telegram (opt-in only).
Data: Notification text containing the Customer's chosen account references.
Location: International (Dubai, UK, BVI operating entities).
Studio: AI image/video generation (Customer opt-in, BYOK)
Only invoked when a Customer supplies their own provider API key in Studio (available on every paid plan). Svmmon relays the Customer's prompt to the Customer's own account with that provider. Svmmon does not supply or share its own keys.
OpenAI, L.L.C.
Purpose: User-initiated AI image/video generation, BYOK. Only when the Customer supplies their own OpenAI API key in Studio.
Data: The Customer's generation prompt and the Customer's own API key (encrypted at rest, used only to relay the Customer's request).
Location: United States.
Google LLC (Gemini API)
Purpose: User-initiated AI image/video generation, BYOK. Only when the Customer supplies their own Gemini API key in Studio.
Data: The Customer's generation prompt and the Customer's own API key (encrypted at rest, used only to relay the Customer's request).
Location: United States.
fal.ai (Fal, Inc.)
Purpose: User-initiated AI image/video generation, BYOK. Only when the Customer supplies their own fal API key in Studio.
Data: The Customer's generation prompt and the Customer's own API key (encrypted at rest, used only to relay the Customer's request).
Location: United States.
Replicate, Inc.
Purpose: User-initiated AI image/video generation, BYOK. Only when the Customer supplies their own Replicate API key in Studio.
Data: The Customer's generation prompt and the Customer's own API key (encrypted at rest, used only to relay the Customer's request).
Location: United States.
Stability AI Ltd.
Purpose: User-initiated AI image/video generation, BYOK. Only when the Customer supplies their own Stability API key in Studio.
Data: The Customer's generation prompt and the Customer's own API key (encrypted at rest, used only to relay the Customer's request).
Location: United Kingdom / United States.
MuAPI
Purpose: User-initiated AI image/video generation, BYOK. Only when the Customer supplies their own MuAPI key in Studio.
Data: The Customer's generation prompt and the Customer's own API key (encrypted at rest, used only to relay the Customer's request).
Location: United States.
Research providers (Customer opt-in)
Only invoked when a Customer runs a query in the Research tool. These receive Customer search queries only, not account data.
Apify Technologies, s.r.o.
Purpose: TikTok + Instagram research data fetching.
Data: Customer's research queries (handles, hashtags). Does not receive Customer account info.
Location: Czech Republic / EU.
Tavily AI
Purpose: Web search for the Research tool.
Data: Search queries.
Location: United States.
NewsAPI.org
Purpose: News search for the Research tool.
Data: Search queries.
Location: United States.
RapidAPI (Reddit + YouTube proxy endpoints)
Purpose: Reddit + secondary YouTube research data fetching.
Data: Search queries.
Location: United States.
Pexels GmbH
Purpose: Stock-photo lookup for the image library.
Data: Search queries.
Location: Germany / EU.
Openverse (WordPress.org / Automattic Inc.)
Purpose: Copyright-free image search for the image library.
Data: Search queries only. No account info.
Location: United States.
Analytics & monitoring (operational)
Used to operate and improve the product. These receive product-event and error data, not your generated content. We do not enable session-replay, and these are never used for advertising.
PostHog, Inc.
Purpose: Product analytics. Conversion-funnel and feature-usage measurement used to operate and improve the product.
Data: Account/user ID, email, and product-event data (sign-up, checkout-started, subscription-started, slideshow-generated). Server-side capture is cookieless. No advertising use; not used to train models.
Location: United States (PostHog US Cloud).
Functional Software, Inc. (Sentry)
Purpose: Application error and performance monitoring to detect and fix production issues.
Data: Error/exception events with request context. May include account/user ID, request URL, and stack traces. Cookieless on the server. No advertising or marketing use.
Location: United States.
Marketing & attribution
Runs on the marketing site only. Consent-gated in the EU, EEA, and UK.
Affiliateo
Purpose: Affiliate referral attribution on the marketing site. Credits the affiliate who referred a visitor.
Data: IP address, browser user-agent, approximate geolocation, and persistent localStorage identifiers (affiliateo_ref, affiliateo_visitor_id, affiliateo_campaign_id). In the EU/EEA/UK this loads only after the visitor accepts the cookie banner.
Location: United States.
Contact
Questions about sub-processors or sub-processor objections: support@svmmonapp.com