Subprocessors
Last updated: October 17, 2026
These are the companies that process personal data on Vidmoat’s behalf. We publish the list by name, rather than referring to “trusted partners”, because you cannot assess a risk you are not allowed to see.
This page supports the Privacy Policy, which explains the legal bases, transfer mechanisms and retention periods behind it.
AI model providers
These are the ones worth reading carefully, because they receive content rather than metadata. Which of them handles a given request depends on availability and on the feature.
| Company | Purpose | What it receives | Where |
|---|---|---|---|
| OpenAI | Agent planning, checking rendered frames, live voice, speech generation, sticker images; grouping projects by type for aggregate statistics when Qwen is unavailable | Instructions, timeline descriptions, transcripts, sampled video frames, microphone audio during a live voice session, text to be spoken. For aggregate statistics: four small still frames of a project's main video and up to 300 words of its transcript, never who made it | United States |
| Anthropic (Claude) | Agent planning on paid plans | Instructions and timeline descriptions | United States |
| Alibaba Cloud (Qwen) | Agent planning, video understanding, checking rendered frames, grouping projects by type for aggregate statistics | Instructions, timeline descriptions, transcripts where relevant, sampled video frames. For aggregate statistics: four small still frames of a project's main video and up to 300 words of its transcript, never who made it | Singapore |
| DeepSeek | Agent planning | Instructions and timeline descriptions | China |
| xAI (Grok) | Agent planning, image / video / speech generation | Instructions and generation prompts | United States |
| OpenRouter | Agent planning fallback | Instructions and timeline descriptions | United States |
| Google (Gemini, Vertex AI) | Video understanding, listening checks, music generation | Uploaded video clips with their soundtrack, short audio extracts, YouTube reference links, music prompts | United States |
| Cloudflare (Workers AI) | Transcription: captions and transcripts made on our servers | The sound of recordings sent for transcription, extracted from the file in pieces of about two minutes. No picture, file name or account details | United States company; its own network, normally Helsinki, Finland |
Transcription goes to Cloudflare. Captions and transcripts made on our servers come from Cloudflare Workers AI, which receives the sound of the recording and nothing else, does not store it and does not train on it. If Cloudflare is unavailable, the sound is transcribed on Vidmoat’s own server instead, and media our server cannot reach is transcribed in your browser. Two other providers above receive audio for other features: Google, with the video it is describing, and OpenAI, from your microphone during live voice. We delete videos from Google once the answer comes back (Google deletes any file it still holds after 48 hours), live voice runs with storage off, and every provider here is used through a paid API whose terms do not allow training on what we send.
Built but not switched on
These integrations exist in Vidmoat’s code and are not enabled. They receive nothing today. We list them because the day one is switched on should not be the day this page is silently wrong, and because you are entitled to know what the software is capable of sending, not only what it sent this morning.
| Company | Purpose | What it receives | Where |
|---|---|---|---|
| OpenAI (transcription) | Speech-to-text, used only if Vidmoat's configuration names it. Built, not enabled, and never a fallback when Cloudflare or our own server fails. | Nothing today. Audio submitted for transcription if enabled. | United States |
Infrastructure
| Company | Purpose | What it receives | Where |
|---|---|---|---|
| Hetzner Online GmbH | Application servers, rendering, database, media storage | All account data and media | Finland |
| Amazon Web Services | Media object storage and mirror | Uploaded and exported media | Sweden (eu-north-1) |
| Cloudflare, Inc. | DNS, security proxy and CDN for our sites; delivery of uploaded and exported media from its network (R2 storage); adaptive streaming of public videos (Stream: published Social posts and shared exports only) | Requests and IP addresses; copies of uploaded and exported media; copies of public videos | Global edge; media stored in Western Europe |
| Vercel Inc. | Web front end hosting | Requests and IP addresses | United States and global edge |
| Google (Firebase Authentication) | Sign-in | Email, name, profile picture, auth tokens | United States |
Your account records and your media are stored in the European Union.
Payments, email and product operations
| Company | Purpose | What it receives | Where |
|---|---|---|---|
| Sentry (Functional Software, Inc.) | Application error monitoring and sampled performance diagnostics; browser reports require usage analytics consent | Error messages, stack traces, release and runtime details; request bodies, cookies, user profiles and session recordings are excluded | United States |
| Dodo Payments | Card payments, merchant of record | Name, email, billing country, payment details | United States and global |
| Paystack | Card payments in supported regions | Name, email, payment details | Nigeria and United States |
| PayPal | Legacy subscriptions | Name, email, payment details | United States and EU |
| Wise (Wise Payments Limited) | Affiliate program payouts | Affiliate payout email, name, country, currency and payout amount | United Kingdom, and the country a payout is sent to |
| Apple / RevenueCat | In-app purchases on iOS | Purchase and subscription identifiers | United States |
| Customer.io | Transactional and marketing email | Email, name, plan, product events | United States and EU |
| PostHog | Website analytics (optional) | Pseudonymous page usage events | United States (website analytics) |
| Vercel Analytics | Page performance | Aggregated page views | United States |
| Tawk.to | Support chat | Name, email, plan, credit balance, chat messages | United States |
| Expo | Push notifications to the mobile app | Push token, notification text | United States |
| Apple Push Notification service | Render progress on iOS | Push token, progress | United States |
Only if you choose to use them
Nothing below receives anything unless you connect it or use the feature it belongs to.
| Company | Purpose | What it receives | Where |
|---|---|---|---|
| YouTube, TikTok, Meta, Threads, LinkedIn, X, Pinterest | Publishing and reading back statistics | The video you chose to post, its title and description, your account identity | Various |
| Composio, Inc. | Connects YouTube, Instagram, Facebook and LinkedIn accounts and holds their access tokens; posts on your instruction. Also connects other apps you choose for the editing agent (for example Google Drive or Gmail) and runs the actions it uses in them, with anything that sends, changes or deletes approved by you first | Platform and app access tokens, the account identity, the video you chose to post (a link to the export, or a copy of the file for YouTube) with its title and caption, the agent's search words for finding an app, and the requests the agent sends a connected app and its answers | United States |
| Telegram, Discord, WhatsApp | Chat bot access to the agent | Messages you send the bot, your platform user id | Various |
| Pexels, Pixabay, Freesound | Stock media search | Your search words | United States and EU |
| Third-party plugins you install | Whatever that plugin does | The arguments the agent sends it, which may include your content. Never your Vidmoat credentials. | Varies by plugin |
Changes to this list
We update this page when a subprocessor is added or removed, and change the date at the top. If you have a data processing agreement with us that requires advance notice of changes, email support@s-ticketing.vidmoat.com and we will add you to the notification list.