Subprocessors
Last updated 4 November 2026
Every company that receives something of yours when you use Cralio: what it does, where it is, what it receives, whether it may train on it, and how long it keeps it. The only other recipient is the timestamping service that countersigns the files we deliver, which receives a hash of each file and never the file.
| Service | What for | Where | May train on it |
|---|---|---|---|
| Contabo GmbH Everything you type, on its way to the database; video uploads, fonts and approved-wording files on their way to storage; and an attached image read back from storage when you ask for a prompt rewrite. It also runs our scheduled tasks and backups and holds the application's configuration. | Hosting for cralio.app and api.cralio.app | Germany (Munich) | Runs no model Infrastructure. Runs no model. Keeps it: Logs until the server's fixed-size log store overwrites them, usually after several months; the web server's request log about two weeks; each job's processing log up to 30 days. Your files only for the length of a request. |
| Amazon Web Services Everything you upload, the finished files, transcripts and subtitle files, and the wording you typed as part of each request. Rendering runs here. Audio extracted for transcription stays on the rendering machine and is deleted when the step ends. | Storage, processing and queueing | Sweden (Stockholm) | Runs no model Infrastructure. Storage, a queue and rendering; no model. Keeps it: Your files: your plan's window, and in any case about 30 days after they were made, except typefaces (your plan's window after their last use) and material we must preserve by law. Database backups, never files: a daily copy kept for about 30 days and never more than about 90. Rendering logs for a limited period. |
| Google For a creative: the image, the wording read off it and its translations, your glossary, your approved wording and the corrections you have made before, then the delivered image to check its words, and again for a second opinion or an edit. For a track: your prompt, style and lyrics, and the drawn cover, to read its lettering. For Generate: your prompt and attached images, with the model settings you chose, and again for a prompt rewrite. | Reading, redrawing and checking static creatives; music, titles and covers; clips and stills from a prompt; rewriting a prompt | United States | No The paid Gemini API: Google's terms say submitted content is not used to improve its models, and processing is under Google's data processing terms. Keeps it: Prompts and outputs are logged for up to 55 days for abuse monitoring. A generated clip is held in our project until Google expires it. |
| HeyGen The source video, fetched once over a link that expires, for dubbing, lip-sync and translated subtitles. Subtitles in the video's own language, Statics, Music, Generate and Reframe never reach it. | Dubbing, lip-sync, and the translation behind translated subtitles | United States | Yes, by default Its terms let it use content it receives to train and improve its models, by default. We do not request an opt-out; accepting this register accepts that use. Keeps it: Its own policy. A deleted account's data stays in its backups for about 60 days. |
| Luma The video you asked to have recut, fetched once over a link that expires, a sentence describing the shot (yours, or one we write from your settings), and the shape and resolution you chose. Nothing from Video, Statics, Music or other Generate tools. | Recutting a finished video to another aspect ratio | United States | No Its API terms say it does not train on what an API customer submits or on the output. We reach it only through the API. Keeps it: Its API terms name no period. The recut comes back over a link of theirs that expires. |
| WaveSpeed The creative, uploaded to its storage, and the wording to draw, with layout instructions, only for creatives ordered at a banner size. Nothing from Video, Music or Generate. | Drawing a creative at an exact banner size | Not published by WaveSpeed; its contracting companies are in Singapore and Hong Kong Transfer: Only on your explicit consent, asked before the first banner-size order. | Yes, by default Its terms let it analyse what it receives and use data drawn from it to improve its services. We do not request an opt-out; your consent to the transfer covers that use. Keeps it: Deletes uploaded images after 7 days and keeps results for up to 7 days. We delete each finished request there as soon as the image is ours. |
| OpenAI Audio extracted from the video, for transcription. No picture. | Speech-to-text | United States | No OpenAI's API terms say it does not use data sent through its API to train its models unless the customer opts in, and we do not. Keeps it: Up to 30 days of abuse-monitoring logs. |
| Supabase Your account, balance and job records, including the words you typed on a job; your glossary, saved prompts, presets, approved wording and client names; review links and what reviewers leave (name, comments, a keyed hash of the IP address); the email we send you; the credit ledger; your acceptances of our documents; waiting-list entries. It also sends the emails that confirm your address and reset your password. No video or audio. | Accounts, job records and the credit ledger | Ireland; Supabase Inc. in the United States may access it remotely | Runs no model A database. No model. Keeps it: For the life of the account; after an erasure, only what the privacy policy lists as kept. A waiting-list address until 90 days after its one message is sent. |
| Stripe Your account email address, our reference for your workspace and plan, what you pay, and the card details you give Stripe directly, which never touch our servers. | Payments | United States and Ireland | Runs no model A payment processor. No model. Keeps it: As their own terms and financial law require. |
| Google Workspace (Gmail) Your email address and the messages we send: a welcome when you register, an invitation if a colleague adds you, a payment received, a card declined, automatic top-up switching itself off, a video finished, a batch finished, a job failed, a file about to expire, credits running low or run out, Platform news, a notice if we remove a file after a copyright notice, an email at least 30 days before a plan price changes, a confirmation when you withdraw from or cancel a contract, with the name and statement you sent, a notice when one of our legal documents changes, a reviewer's message when somebody you shared work with rejects or comments on a creative, with their comment and the name they typed, and, for a waiting-list address, the single message it was left for. Notices about your work name the file they are about. No file of yours is ever attached. | The transactional email we send you | Ireland, with onward transfer to the United States under Google's terms | Runs no model A mailbox. No model. Keeps it: As their own terms provide. |
| Telegram A reason code, counts and amounts about the service, and a reference to our own record. No personal data. | Our own alerts | Outside the EU | Runs no model A chat app. No model. Keeps it: Telegram's own. |
| Slack A reason code, counts and amounts about the service, and a reference to our own record. No personal data. | Our own alerts | United States | Runs no model A chat app. No model. Keeps it: Slack's own. |
Each training answer was read from that company’s own terms, linked in its row. Two may use what they receive to improve their models: HeyGen, for dubbing, lip-sync and translated subtitles, and WaveSpeed, for creatives ordered at a banner size. To keep material away from them, use subtitles in the video’s own language and order creatives at other sizes.
When this list changes. A new or replacement company is posted on this page, and in Annex II of the data processing addendum, and every account is emailed. If a job would send your material to it, new work starts only after you accept this page with that company on it: your next submission asks you to, before anything is reserved or sent to a provider. You may object within 14 days of the posting under clause 6 of the addendum, and end the part of the service that needs the company with a refund of what you prepaid for it. For anything not covered here, write to info@cralio.app.