Legal
Subprocessors.
Effective and last updated: July 27, 2026
Every third party that processes personal data on Fraiwy’s behalf — by name, with what they receive, where they process it, and the transfer safeguard we rely on.
1. What this page is
These are the third parties that process personal data on our behalf. We update this page before a new subprocessor starts, and we give 30 days’ notice by email before adding any subprocessor that will handle your creative content, so you have time to object or leave. To subscribe to change notifications, write to contact@fraiwy.com.
* Entries marked with an asterisk are undergoing a re-verification of the provider’s current data-processing and no-training terms. Until it completes, treat the strictest reading as true: assume the provider receives exactly the data listed and choose your model accordingly. We publish updates here as each verification completes.
2. AI model providers
A model provider receives your prompt, any reference media you attached, and your generation settings — only for the generation you asked it to run, and only the provider of the model you picked.
| Provider | Purpose | Data | Location | Transfer | Trains on your content? | Retention |
|---|---|---|---|---|---|---|
| OpenAI (GPT Image, Sora) | Image and video generation | Prompts, reference media you attach, generation settings | United States | EU–US Data Privacy Framework | No | Limited API retention for abuse monitoring, then deleted |
| Google Cloud / Vertex AI (Imagen, Veo) | Image and video generation | Prompts, reference media you attach, generation settings | United States | EU–US Data Privacy Framework | No | Processed to return the result; not used to train Google models |
| Black Forest Labs (FLUX) | Image generation | Prompts, reference media you attach, generation settings | Germany / United States | Standard Contractual Clauses | No | Short-lived API retention to deliver the result |
| xAI (Grok Imagine) | Image and video generation | Prompts, reference media you attach, generation settings | United States | Standard Contractual Clauses | No | Short-lived API retention to deliver the result |
| Topaz Labs | Upscaling and enhancement | Media you submit for enhancement | United States | Standard Contractual Clauses | No | Short-lived API retention to deliver the result |
| Reve | Image generation and editing | Prompts, reference media you attach, generation settings | United States | Standard Contractual Clauses | No | Short-lived API retention to deliver the result |
| RunPod (Fraiwy custom models) | GPU compute for Fraiwy's own models (fraiwy-soul, fraiwy-popcorn, fraiwy-dop) | Prompts, reference media you attach, generation settings | United States / EU regions | Standard Contractual Clauses | No | Compute only — nothing persists after the job completes |
| Hume AI (Octave) | Text-to-speech | Text you convert to speech, voice settings | United States | Standard Contractual Clauses | No | Short-lived API retention to deliver the result |
| ElevenLabs | Text-to-speech, sound effects, voice isolation and voice change | Text and audio you submit, voice settings | United States | Standard Contractual Clauses | No | Short-lived API retention to deliver the result |
| Anthropic (Claude) | Prompt coaching | The prompt text you ask for help with | United States | EU–US Data Privacy Framework | No | Limited API retention, not used for model training |
| Kie.ai (model aggregator) | Fallback routing for select image/video models | Prompts, reference media you attach, generation settings | Under verification | Standard Contractual Clauses | No | Per Kie.ai API terms; listed pending re-verification |
| Kuaishou (Kling) | Image, video and avatar generation | Prompts, reference media you attach, generation settings | China / Singapore | Standard Contractual Clauses | No | Per Kling API terms; listed pending re-verification |
| BytePlus / Volcengine (Seedream, Seedance) | Image and video generation | Prompts, reference media you attach, generation settings | China / Singapore | Standard Contractual Clauses | No | Per BytePlus API terms; listed pending re-verification |
| Alibaba Cloud (Qwen, Wan) | Image and video generation | Prompts, reference media you attach, generation settings | China / Singapore | Standard Contractual Clauses | No | Per Alibaba Cloud Model Studio terms; listed pending re-verification |
3. Infrastructure
| Provider | Purpose | Data | Location | Transfer | Retention |
|---|---|---|---|---|---|
| Vercel | Web hosting and CDN | Request data (IP address, headers), rendered pages | United States (global edge) | EU–US Data Privacy Framework | Request logs, short-lived |
| Railway | API hosting, PostgreSQL database, Redis queue | All service data at rest (accounts, jobs, Essence ledger) | United States / EU regions | Standard Contractual Clauses | For as long as your account exists (see retention schedule) |
| Cloudflare (R2) | Media storage for uploads and generated outputs | Your uploads and generated media | United States (global network) | EU–US Data Privacy Framework | Until you delete the media or your account |
| Supabase | Authentication | Email address, OAuth identifiers, session tokens | EU region | EEA — no transfer | For as long as your account exists |
| Stripe Payments Europe, Ltd. | Payments, subscriptions, invoicing | Billing name and address, payment card data (collected directly by Stripe — card numbers never reach our servers) | Ireland / United States | EU–US Data Privacy Framework | Per Stripe's own legal obligations (independent controller for card data) |
4. Support, email and telemetry
| Provider | Purpose | Data | Location | Transfer | Retention |
|---|---|---|---|---|---|
| Intercom | In-app support messenger (loads only with functional-cookie consent) | Name, email, user id, support conversations, messenger cookies | United States | Standard Contractual Clauses | For the life of the support relationship |
| Resend | Transactional email delivery | Email address, email contents (receipts, notifications, confirmations) | United States | Standard Contractual Clauses | Short-lived delivery logs |
| Plausible Analytics | Cookieless, aggregated product analytics | Page views and events without cookies or persistent identifiers | European Union | EEA — no transfer | Aggregated statistics only |
| Sentry (Functional Software, Inc.) | Error tracking and crash reporting | Error events, browser/OS context, IP address | United States | Standard Contractual Clauses | 90 days (Sentry default event retention) |
5. Transfer mechanisms
“EU–US Data Privacy Framework” means the recipient is certified under the European Commission’s adequacy decision for the DPF (Art. 45 GDPR). “Standard Contractual Clauses” means the Commission’s SCCs under Art. 46(2)(c) GDPR together with a transfer impact assessment. You can request a copy of the relevant safeguards at contact@fraiwy.com.
Changelog
- July 27, 2026 — First published register.