Subprocessors

Overview

Smith & Johnson, Inc. uses the third-party services below to operate Sundream. Under the GDPR these are our subprocessors: they process customer personal data on our instructions, under contract, and only to provide the service.

We publish this list so customers can assess it before signing and can see when it changes. It is accurate as of the date above.

Infrastructure

• Supabase — Postgres database, authentication, and file storage. Processes account identifiers, credentials, workspace content, uploaded references, and generated media. United States.
• Fly.io — hosting for our application and background workers. Processes any data in transit through the API, plus operational logs. United States.
• Vercel — hosting and content delivery for the web application. Processes request metadata and IP addresses. United States, with a global edge network.

AI and media generation

These providers receive the prompts, scripts, reference media, voice samples, and related project context needed to fulfil a generation, speech, or voice-cloning request. They are used only when you invoke a feature that calls them. We do not authorize them to train general-purpose models on private workspace content; limited operational, security, and abuse-monitoring retention is governed by the applicable business or API terms.

• OpenAI — text and image generation. United States.
• Anthropic — text generation and creative assistance. United States.
• Google — text generation via the Gemini API. United States.
• Replicate — hosted image, video, speech, and voice-cloning model inference. Processes requested prompts, references, generated media, and voice samples. United States.
• ElevenLabs — speech synthesis and voice cloning. Processes scripts, voice settings, uploaded voice samples, and generated audio. United States.

Payments

• Stripe — payment processing, subscription billing, invoicing, and tax calculation. Processes billing contact details, addresses, tax identifiers, and payment metadata. We never receive or store full card numbers. United States.

Analytics and diagnostics

• PostHog — product analytics, session replay, and error monitoring. Processes usage events, device and browser metadata, and account identifiers once you are signed in. Analytics and session replay run only where you have given consent; without it we capture error diagnostics with no persistent identifier. United States.

Transactional email

Account emails — confirmations, password resets, and security notices — are sent through Supabase, listed above. We do not currently use a separate marketing email provider.

Changes to this list

We may add or replace subprocessors as the service changes, and will update this page when we do.

Our Data Processing Addendum applies automatically where the GDPR governs your use of Sundream, and incorporates this list. To be notified before a subprocessor changes, or for a countersigned copy of the DPA, write to support@sundream.studio.