Legal · v1.0.0
Sub-processors
Effective 23 May 2026
This page lists every third-party service that processes personal data on behalf of CineForge. It is provided to satisfy the transparency requirement under UK GDPR Article 28 and as a reference for enterprise customers conducting due diligence.
01
Overview
A “sub-processor” is any third party we engage to help deliver the service that, in the course of doing so, processes personal data of CineForge users. We choose sub-processors with care, contractually require equivalent data protection standards, and prefer providers with EU/UK data residency where the service allows it.
For our broader privacy commitments, see the Privacy Policy.
02
Current sub-processors
The table below is the current list. We update it when we add or remove sub-processors; see section 3 for how we notify customers of changes.
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Clerk, Inc. | User authentication, session management, account email storage. | United States (Delaware) | EU-US Data Privacy Framework + Standard Contractual Clauses |
| Stripe, Inc. / Stripe Payments UK Ltd. | Payment processing, subscription billing, fraud prevention. | United Kingdom + United States | UK operations under UK GDPR; US transfers under SCCs |
| Neon, Inc. | Database hosting (PostgreSQL). Stores project data, generated content, account metadata. | United States | Standard Contractual Clauses; EU region selectable for enterprise |
| Anthropic PBC | AI inference for story bible generation, scene generation, and related features. | United States | Standard Contractual Clauses; zero-retention API endpoints used |
| OpenAI, OpCo, LLC | Text embeddings for the DNA library retrieval system. Does not see prompt content beyond the embedding input. | United States | Standard Contractual Clauses; zero-retention API endpoints used |
| Cloudflare, Inc. | Object storage (R2) for generated assets and exports; edge network and DDoS protection. | United States (global edge presence including UK) | Standard Contractual Clauses; EU/UK edge nodes for at-rest data |
| Resend, Inc. | Transactional email delivery (sign-in links, billing receipts, completion notifications). | United States | Standard Contractual Clauses |
| Vercel, Inc. | Application hosting and edge functions. | United States | Standard Contractual Clauses; UK/EU regions selectable |
| Axiom, Inc. | Application logging and observability. | United States / Germany | Standard Contractual Clauses; EU region for production logs |
| Sentry (Functional Software, Inc.) | Error monitoring. Sees stack traces and minimal request context; configured to redact request bodies. | United States | Standard Contractual Clauses |
03
Notification of changes
We will notify registered users by email at least 30 days before adding a new sub-processor or before any change that meaningfully alters where personal data is processed. Enterprise customers may negotiate longer notice periods through their DPA.
Where a customer has a right to object to a new sub-processor (typically enterprise customers under a negotiated DPA), the notice period and objection procedure are set out in the DPA.
This document is version 1.0.0, effective 23 May 2026. We will notify registered users by email at least 30 days before any material change takes effect.
Questions? Email hello@cineforge.co.uk.