Sub-processors
Last updated: June 20, 2026
This page lists the third-party companies (“sub-processors”) that Creofy engages to process personal data on your behalf when you use our platform. It is referenced from our Privacy Policy and our Data Processing Agreement.
Change notifications
We will provide at least 14 days' prior written notice by email to your registered account address before adding or replacing a material sub-processor. If you have questions or wish to object, email support@creofy.io (subject: Sub-processor objection) within the notice period.
Current sub-processors
| Provider | Purpose | Location | Data processed |
|---|---|---|---|
| Clerk | Authentication and user management | USA | Account identity, session tokens |
| Neon (Neon Inc.) | Managed PostgreSQL database | USA | All platform data |
| Cloudflare (R2 / Workers) | Object storage and media delivery | USA / Global CDN | Uploaded media, generated content, face reference images |
| Vercel Inc. | Web application hosting | USA / Global | HTTP request metadata, IP addresses |
| Railway Corp. | API and AI service hosting | USA | Job inputs and outputs, logs |
| Upstash Inc. | Redis job queue (BullMQ) | USA / EU | Job payloads (transient) |
| Stripe Inc. | Payment processing and billing | USA / Ireland (EU) | Billing details, subscription status |
| Fal.ai | AI image generation (FLUX, NB2) | USA | Face reference images, generation prompts |
| Runway ML Inc. | AI video generation | USA | Reference images, generation prompts |
| HeyGen Inc. | AI avatar video generation | USA | Face geometry, avatar configurations |
| ElevenLabs Inc. | Voice cloning and audio generation | USA / EU | Voice recordings, voiceprints |
| OpenAI Inc. | Content quality scoring (GPT-4o vision) | USA | Generated images for audit (no PII) |
| Replicate Inc. | AI model inference (supplemental) | USA | Generation prompts, reference images |
| Pinecone Inc. | Vector embeddings database | USA | Content embeddings (anonymised) |
| PostHog Inc. | Product analytics | USA / EU | Usage events, anonymised identifiers |
| Sentry (Functional Software) | Error monitoring | USA | Error logs, stack traces (no biometric data) |
| Resend Inc. | Transactional email | USA | Email address, notification content |
International transfer mechanisms
All sub-processors listed above are located in, or transfer data to, the United States. For transfers from the UK or EEA, Creofy relies on Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA) with each sub-processor, or on a relevant adequacy decision where one exists.
Contact
Questions about our sub-processors: support@creofy.io (subject: Sub-processors).