Overview
Smith & Johnson, Inc. uses the third-party services below to operate Sundream. Under the GDPR these are our subprocessors: they process customer personal data on our instructions, under contract, and only to provide the service.
We publish this list so customers can assess it before signing and can see when it changes. It is accurate as of the date above.
Infrastructure
- Supabase — Postgres database, authentication, and file storage. Processes account identifiers, credentials, workspace content, uploaded references, and generated media. United States.
- Fly.io — hosting for our application and background workers. Processes any data in transit through the API, plus operational logs. United States.
- Vercel — hosting and content delivery for the web application. Processes request metadata and IP addresses. United States, with a global edge network.
AI and media generation
These providers receive the prompts, scripts, reference images, and related project context needed to fulfil a generation you request. They are used only when you invoke a feature that calls them.
- OpenAI — text and image generation. United States.
- Anthropic — text generation and creative assistance. United States.
- Google — text generation via the Gemini API. United States.
- Replicate — hosted image and video model inference. United States.
- ElevenLabs — speech and voice generation. United States.
Payments
- Stripe — payment processing, subscription billing, invoicing, and tax calculation. Processes billing contact details, addresses, tax identifiers, and payment metadata. We never receive or store full card numbers. United States.
Analytics and diagnostics
- PostHog — product analytics, session replay, and error monitoring. Processes usage events, device and browser metadata, and account identifiers once you are signed in. Analytics and session replay run only where you have given consent; without it we capture error diagnostics with no persistent identifier. United States.
Transactional email
Account emails — confirmations, password resets, and security notices — are sent through Supabase, listed above. We do not currently use a separate marketing email provider.
Changes to this list
We may add or replace subprocessors as the service changes, and will update this page when we do.
Our Data Processing Addendum applies automatically where the GDPR governs your use of Sundream, and incorporates this list. To be notified before a subprocessor changes, or for a countersigned copy of the DPA, write to support@sundreamstudio.com.