Subprocessors
1. Overview
To provide the Craftology platform, ICVR LLC engages trusted third-party companies ("subprocessors") that may process personal data on our behalf. This page lists those subprocessors, the service they provide, and where they process data. It supports our commitments under the GDPR (Art. 28) and our Data Processing Addendum. Section 2.6 also lists third parties on our marketing website that act as independent or joint controllers rather than on our behalf; they are shown for transparency and are not subprocessors.
2. Platform & Service Subprocessors
2.1. Infrastructure
| Subprocessor | Purpose | Data processed | Location | Safeguards |
|---|---|---|---|---|
| Google LLC — Google Cloud Platform (GCP) | Cloud hosting & content storage | Account data, user-generated content, application data | United States | DPA + SCCs |
| Amazon Web Services, Inc. | Cloud hosting & content storage | Account data, user-generated content, application data | United States | DPA + SCCs |
| Oracle America, Inc. — Oracle Cloud Infrastructure (OCI) | Cloud hosting & GPU workloads | Transient working copies of input and output assets | United States | DPA + SCCs |
| Cloudflare, Inc. | CDN & edge delivery + object storage (R2) for customer-generated content and thumbnails, and website static assets; DDoS/WAF | Generated media & thumbnails (may include likeness/personal data), request metadata, visitor IP | Global edge network (US HQ); EU storage of delivered media available on request | DPA + SCCs; DPF-certified |
2.2. AI inference providers
| Subprocessor | Purpose | Data processed | Location | Safeguards |
|---|---|---|---|---|
| Google LLC — Vertex AI / Gemini | Image & video generation (Gemini & Veo) | Prompts + input assets (images, video) submitted for input | US (region-pinned) | DPA + SCCs; no-training (Service Specific Terms §18) |
| OpenAI, L.L.C. | Image generation (GPT Image 2) · LLM inference (OpenAI API) | Prompts + assets submitted for input | United States | DPA + SCCs; no-training (Services Agreement §4.2) |
| Amazon Web Services, Inc. — Amazon Bedrock | LLM inference (Anthropic Claude models) | Prompts + inputs | US (AWS region) | DPA + SCCs; no-training (AWS Service Terms §50.3 scope + §50.12.5; Bedrock FAQ) |
| Alibaba Cloud (Model Studio / DashScope-intl) | Image generation/editing (Qwen, Wan) | Prompts + input assets (images, video, audio) | Singapore (intl endpoint) | DPA + SCCs; no-training (Model Studio data policy) |
| ByteDance / BytePlus Pte. Ltd. | Video/image generation (Seedream, Seedance) | Prompts + input assets (images, video, audio) | Singapore (API endpoint); processing in Malaysia / Indonesia | DPA + SCCs; no-training (ModelArk data processing terms) |
2.3. Payments & billing
| Subprocessor | Purpose | Data processed | Location | Safeguards |
|---|---|---|---|---|
| Stripe, Inc. | Payment processing | Name, billing details (tokenized card data) | United States | DPA + SCCs |
| Metronome, Inc. | Usage metering & billing | Account ID, usage/metering data | United States | DPA + SCCs on request |
2.4. Support & Communications
| Subprocessor | Purpose | Data processed | Location | Safeguards |
|---|---|---|---|---|
| JetBrains s.r.o. — YouTrack Helpdesk | Customer support / helpdesk | Name, email, support ticket content | EU (Frankfurt) | DPA + SCCs |
| Google LLC — Google Workspace (Business) | Email & internal communications | Email address, message content | United States / EU | DPA + SCCs |
2.5. Analytics in the Craftology Studio (studio.craftology.ai)
| Subprocessor | Purpose | Data processed | Location | Safeguards |
|---|---|---|---|---|
| Google LLC — Google Analytics (Opt-in) | Product analytics (platform) | Usage data, device/identifiers, IP | United States | DPA + SCCs |
| PostHog, Inc. (Opt-in) | Product analytics (platform) | Usage/event data, identifiers | United States | DPA + SCCs |
2.6. Website (craftology.io): processors and third-party controllers
| Vendor | Purpose | Data processed | Location | Role / safeguards |
|---|---|---|---|---|
| Viral Loops Technologies Inc. | Waitlist & referral program | Email, referral ID, waitlist position | EU (Ireland) | Processor; DPA |
| Google LLC — Google Analytics 4 (via Google Tag Manager) | Website analytics | Usage data, device/identifiers, IP | United States | Processor; DPA + SCCs |
| Hotjar Ltd | Website analytics & session recording | Usage/session data, device/browser info | EU (Ireland) | Processor; DPA |
| Google LLC — reCAPTCHA | Bot protection on the waitlist form | IP, device/browser signals | United States | Independent controller; Google Privacy Policy |
| Meta Platforms Ireland Ltd — Meta Pixel | Ad measurement & retargeting | Pixel events, cookie IDs (_fbp, fr), IP | EU / United States | Joint controller; Meta Business Tools Terms |
| Google LLC — YouTube (privacy-enhanced embed) | Embedded video, loaded on play | IP, device data, viewing activity | United States | Independent controller; Google Privacy Policy |
Which of these load, and when, depends on the visitor's region and consent choices — see our Cookie Policy (§4.1).
3. International Transfers
Where personal data of individuals in the EU, UK, or other regulated jurisdictions is transferred to a subprocessor in another country, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (and the UK International Data Transfer Addendum) together with supplementary measures.
4. Changes and Notifications
We may update this list as we add, remove, or change subprocessors. Customers are notified by email at least 15 days before a new subprocessor begins processing customer personal data, as set out in the Data Processing Addendum, and may object as described there. This notice applies to subprocessors of customer personal data; changes to the website vendors in Section 2.6 are reflected by updating this page. Others can request notifications by emailing privacy@craftology.io.
5. Contact
Questions about our subprocessors? Email privacy@craftology.io.