Subprocessors
Last updated: September 26, 2026
McLeuker AI engages the following third-party subprocessors to deliver our Service. We maintain a Data Processing Agreement (DPA) with appropriate safeguards — including the European Commission's Standard Contractual Clauses (SCCs) for transfers outside the EEA — with each subprocessor, or are executing one as part of our compliance program. Where a subprocessor's processing region is being confirmed, this is marked below.
Not all subprocessors process personal data on every request — for example, AI inference and generation providers only receive the content you submit for a given task. Items marked "⚠ to be confirmed" indicate a data-residency commitment we are confirming contractually with the vendor.
Changed on September 26, 2026: Railway serves the backend from its US East (Virginia) region, beside the database, instead of US West (California); it runs on Railway's own hardware, not Google Cloud. The Amazon Web Services (S3) row is removed: no S3 bucket is configured, and the files you upload are stored in Supabase Storage (USA).
Changed on September 24, 2026: BytePlus (ByteDance) is added back (September 2026) for video generation (Seedance) and for image generation from text prompts (Seedream), each used only when the primary provider cannot serve a request; images you upload as references are not sent to it, and it received no data between June and September 2026. xAI (Grok) now also generates voice and podcast audio. EvoLink (image and video generation) remains removed since June 2026 and receives no data from the Service.
Infrastructure & Hosting
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Vercel Inc. | Frontend hosting, CDN, edge functions | USA (Edge: Global) | SCCs + DPA |
| Railway Corp. | Backend API hosting and compute | USA (US East, Virginia) | SCCs + DPA |
| Supabase Inc. | Database, authentication, file storage (including the files you upload) | USA (US East, Virginia) | SCCs + DPA |
| E2B (FoundryLabs, Inc.) | Isolated code-execution sandbox — runs user-authored code and processes uploaded files during generation | USA | SCCs + DPA |
AI & Machine Learning — Language Models
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| xAI (Grok) | Large language model inference for reasoning and content generation | USA | SCCs + DPA |
| Google (Gemini / DeepMind) | Large language model inference; opt-in web search grounding (off by default) | USA (DPF) | DPA + EU-US Data Privacy Framework |
| Moonshot AI (Kimi) | Large language model inference for agentic tasks | USA (entity), ⚠ region to be confirmed | DPA + SCCs |
| OpenAI, L.L.C. | Text embeddings for semantic memory and retrieval over user content | USA (DPF) | DPA + EU-US Data Privacy Framework |
AI Generation — Image, Video & Voice
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| xAI (Grok) | AI image generation; AI video generation; AI voice / podcast generation (text-to-speech) | USA | SCCs + DPA |
| OpenAI, L.L.C. | AI image generation; AI voice / podcast generation (text-to-speech) | USA (DPF) | DPA + EU-US Data Privacy Framework |
| Alibaba Cloud (Qwen / DashScope) | AI image and video generation | Singapore (no EU adequacy decision) | DPA + SCCs (Module 2) + Transfer Impact Assessment for the Singapore generation leg |
| BytePlus (ByteDance: Seedance, Seedream) | AI video generation; AI image generation from text prompts (each used when the primary provider cannot serve a request) | Singapore (no EU adequacy decision) | DPA + SCCs (Module 2) + Transfer Impact Assessment for the Singapore generation leg |
| Google (Gemini) | AI image generation; AI voice / podcast generation (text-to-speech) | USA (DPF) / EU-resident option via Vertex AI (europe-west) | DPA + EU-US Data Privacy Framework |
Content Sourcing
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Google (YouTube Data API) | Fashion-trend content sourcing based on your search intent | USA | SCCs + DPA |
| Pinterest, Inc. | Fashion-trend content sourcing based on your search intent | USA | SCCs + DPA |
| Unsplash | Royalty-free image sourcing | USA / Global | SCCs + DPA |
| Pexels | Royalty-free image and video sourcing | USA / Global | SCCs + DPA |
Search, Retrieval & Rendering
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Serper | Web search (Google results API) — processes search queries | USA | SCCs + DPA |
| Firecrawl | Web content retrieval and rendering to markdown | USA | SCCs + DPA |
| Exa | Neural web search and retrieval | USA | SCCs + DPA |
| SerpAPI | Structured web search results | USA | SCCs + DPA |
| DuckDuckGo | Web search (fallback provider) | USA | No formal DPA: a keyless, no-account public endpoint that receives the search query only |
| Browserless | Server-side Chromium rendering (HTML → PDF / screenshots) of generated documents | Global / see vendor DPA | SCCs + DPA |
Connected Accounts
This is the one category where data flows into the Service from an account you own, rather than out to a provider.
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Google (Google Drive) | With your explicit authorization, connects to your Google Drive so the agent can read and work with your files. The connector currently requests the full Drive scope, so the authorization is not limited to individual files you pick. We store your access credentials securely and encrypted; you can revoke access at any time. | USA (DPF) | DPA + EU-US Data Privacy Framework |
Payments
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Stripe, Inc. / Stripe Payments Europe | Payment processing and subscription billing (card data is handled by Stripe; we store only Stripe identifiers) | USA / Ireland (EU) | SCCs + DPA |
Communications
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Resend | Transactional and newsletter email (account, billing and notification messages); an SMTP provider is used as a fallback | USA / EU | SCCs + DPA |
Change Notifications
We will update this page whenever we add or remove a subprocessor. If you have subscribed to notifications, we will inform you of material changes at least 30 days before they take effect, giving you the opportunity to object. To subscribe to subprocessor change notifications, please contact dpo@mcleuker.com.