Legal
Sub-processors
Everyone who processes data on our behalf, what they do, and where they are. Including the one exception to EU-only processing, which is named here rather than implied away.
This list is the one the data processing agreement refers to. We announce a new or replacement sub-processor before it starts processing, and you may object on reasonable data protection grounds.
Processing today
All of these are in the European Union.
| Processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting for the application, the API, the render workers and the queue | Germany |
| Neon Inc. | The managed Postgres database | Frankfurt, Germany (EU region) |
| Cloudflare, Inc. | Object storage for assets and rendered files (R2), edge delivery of this marketing site, and the waitlist: the email address you leave on the site, kept in a D1 database | EU jurisdiction for storage and for the waitlist; global edge for the site’s pages, which hold no personal data |
| Resend, Inc. | Transactional email only - verification links, password resets, invitations. No marketing mail | EU region |
| Google Ireland Limited | Only if you choose to sign in with Google. The exchange carries your email address and name; no workspace content is involved | EU establishment, with the provider’s own transfers |
The AI exception, stated plainly
Everything in the product - rendering, storage, the database, identity - is in the EU. There is no US region and there is no plan for one.
The AI features are the exception. The assistant and the editor copilot call Anthropic, AI image fill, video generation and background removal call fal.ai or Higgsfield, whichever this deployment is set to, and premium voiceover calls ElevenLabs. All four are in the United States; standard voiceover runs at Mistral AI, in France. We could have described this as "EU-first" and left you to discover it; instead it has its own heading.
What is and is not sent, exactly:
- Sent: the text of a prompt, small JSON describing a template's structure, the text a voiceover speaks, and - for image AI only - the specific image being generated from or having its background removed.
- Not sent: your template files, your rendered artwork, your assets, your account data. The assistant is handed URLs and small JSON, never image bytes, and that is enforced in the code rather than promised here.
None of these features has been released. Until one is, nothing goes to either provider - and when one does, it arrives with a changelog entry, like everything else.
Named in advance
These process nothing today. Each moves to the table above when the capability that needs it ships, announced beforehand as section 5 of the DPA requires.
| Processor | Purpose | Location |
|---|---|---|
| Anthropic PBC | The AI assistant and the editor copilot. Prompts and small JSON transit the model; template files and rendered artwork do not, and no image bytes are sent | United States |
| fal.ai | AI image fill and background removal. Only the prompt, or the specific image being processed, is sent | United States |
| Higgsfield AI | AI image and video generation, as the alternative provider for those capabilities. Only the prompt, and the specific image a film starts from, is sent | United States |
| Mistral AI | Voiceover and caption timing (text to speech, and transcription of the speech it made). Only the text to be spoken is sent | France (EU endpoint) |
| ElevenLabs, Inc. | Premium voiceover, as the alternative provider for text to speech. Only the text to be spoken is sent. Not used until training on what we send is switched off for our account | United States |
| Dodo Payments | Payment processing and invoicing when paid plans open | Merchant of record; see their own sub-processor terms |
| Sentry (EU) | Error monitoring. Stack traces and request identifiers, not workspace content | EU region |
| PostHog (EU) | Product analytics, if enabled | EU region |
Not sub-processors
Somewhere you connect your own account - your own object storage, or a delivery target of yours - is your processor, not ours. We use your credential to put your files where you told us to, and every such request passes the same egress guard as any other outbound call.
Contact
privacy@kinoplate.com, including to be told when this list changes.