Sub-processors
Last updated 24 October 2026
These are the providers that process personal data on behalf of Kreamatic, what they do, where the data is processed and the basis we rely on for any transfer outside the EEA.
Google Cloud Platform
- Purpose
- infrastructure hosting, database and file storage.
- Location
- EU/EEA
- Transfer
- No transfer outside the EEA. No transfer basis is needed, because the data stays in the EU/EEA.
Firebase Authentication (Google)
- Purpose
- sign-in and account identity (e-mail address, name and credentials).
- Location
- chosen by the provider, not by us
- Transfer
- We do not select the location, so a transfer outside the EEA can occur. Transfer basis: the EU-US Data Privacy Framework, under which the provider is certified.
Stripe, Inc.
- Purpose
- payment processing and billing (customer e-mail and name, billing details).
- Location
- EU and United States
- Transfer
- Data is transferred outside the EEA. Transfer basis: the EU-US Data Privacy Framework, under which the provider is certified.
Resend
- Purpose
- delivery of e-mail sent by the service (recipient address and message content).
- Location
- chosen by the provider, not by us
- Transfer
- We do not select the location, so a transfer outside the EEA can occur. Transfer basis: the EU-US Data Privacy Framework, under which the provider is certified.
Anthropic
- Purpose
- AI features: text, documents and images you submit for analysis, for example production documents, receipts and images in Location Catalog and Casting Catalog that are tagged with AI.
- Location
- the provider's default endpoint in the United States
- Transfer
- Data is transferred outside the EEA. Transfer basis: the EU Standard Contractual Clauses (SCCs).
OpenAI
- Purpose
- AI features, same purpose.
- Location
- the provider's default endpoint in the United States
- Transfer
- Data is transferred outside the EEA. Transfer basis: the EU Standard Contractual Clauses (SCCs).
Google Gemini
- Purpose
- AI features, same purpose.
- Location
- chosen by the provider, not by us
- Transfer
- We do not select the location, so a transfer outside the EEA can occur. Transfer basis: the EU-US Data Privacy Framework, under which the provider is certified.
Google Cloud Vision
- Purpose
- text recognition on receipts and scanned forms.
- Location
- EU endpoint
- Transfer
- No transfer outside the EEA. No transfer basis is needed, because the data stays in the EU/EEA.
Google Maps Platform
- Purpose
- address lookup, geocoding and place search (addresses and search text you enter).
- Location
- chosen by the provider, not by us
- Transfer
- We do not select the location, so a transfer outside the EEA can occur. Transfer basis: the EU-US Data Privacy Framework, under which the provider is certified.
Google Drive
- Purpose
- file import, only when you connect your own Google account.
- Location
- chosen by the provider, not by us
- Transfer
- We do not select the location, so a transfer outside the EEA can occur. Transfer basis: the EU-US Data Privacy Framework, under which the provider is certified.
Cloudflare Turnstile
- Purpose
- bot protection on public forms (visitor token and IP address).
- Location
- chosen by the provider, not by us
- Transfer
- We do not select the location, so a transfer outside the EEA can occur. Transfer basis: the EU-US Data Privacy Framework, under which the provider is certified.
Google reCAPTCHA Enterprise (App Check)
- Purpose
- bot protection on sign-in, registration and passkey (browser and device signals and IP address).
- Location
- chosen by the provider, not by us
- Transfer
- We do not select the location, so a transfer outside the EEA can occur. Transfer basis: the EU-US Data Privacy Framework, under which the provider is certified.
Google Analytics
- Purpose
- usage analytics, only with your consent.
- Location
- chosen by the provider, not by us
- Transfer
- We do not select the location, so a transfer outside the EEA can occur. Transfer basis: the EU-US Data Privacy Framework, under which the provider is certified.
Cloudflare
- Purpose
- content delivery (CDN) and security for the website and the platform (IP address and the requests your browser sends).
- Location
- chosen by the provider, not by us
- Transfer
- We do not select the location, so a transfer outside the EEA can occur. Transfer basis: the EU-US Data Privacy Framework, under which the provider is certified.
OpenStreetMap Foundation
- Purpose
- address search, geocoding and nearby place search (addresses and search text you enter).
- Location
- chosen by the provider, not by us
- Transfer
- We do not select the location, so a transfer outside the EEA can occur. Transfer basis: the European Commission decision that the United Kingdom ensures an adequate level of protection.
CARTO
- Purpose
- map tiles, the background map shown in the platform (IP address and the map area you view).
- Location
- chosen by the provider, not by us
- Transfer
- We do not select the location, so a transfer outside the EEA can occur. Transfer basis: the EU Standard Contractual Clauses (SCCs).
This list forms part of the data processing agreement in the terms (Annex A.5). We notify the account holder, for organizations the administrators, by e-mail at least 30 days before a new sub-processor starts processing personal data. Send objections to [email protected].