1. Current sub-processors
| Provider | What it does for us | Data it receives | Location |
|---|---|---|---|
| Supabase | Authentication and primary PostgreSQL database (including pgvector embeddings). | Account email, name and password hash; campaigns, briefs, brand voice, drafts and published-content records; encrypted platform OAuth tokens and encrypted API keys; usage and billing records; embeddings of your high-performing posts. | London, United Kingdom (AWS eu-west-2) |
| Railway | Hosts the API, background workers, scheduler and the Redis job queue. | All Customer Data in transit and in memory while jobs run; job payloads (IDs, prompts, status) in Redis; application logs. | United States (US West) |
| Vercel | Hosts the web application (autopostr.app). | Request metadata (IP address, user agent, URLs) and the pages and API calls your browser makes. | United States / global edge network |
| Cloudflare (R2) | Object storage for generated and uploaded media (images, audio, video, thumbnails). | Media files you upload and media generated for you. | Cloudflare R2 (managed global storage) |
| OpenAI | Text generation (research, writing, critique), image generation and vision quality checks, and text embeddings. | Prompts built from your niche, brief, brand voice, trend research and sample posts; images you supply for editing or checks; text of posts to be embedded. | United States |
| ElevenLabs | Text-to-speech voiceovers and speech-to-text transcription. | Script text to be voiced; audio you upload for transcription (cartoon / source-to-video features). | United States / EU |
| fal.ai | AI image and video generation. | Visual prompts derived from your content and, where relevant, reference images. | United States |
| Stripe | Subscription billing and payment processing. | Name, email, billing details and payment method (entered directly with Stripe; we never see full card numbers); subscription status. | United States / global |
| Resend | Transactional and onboarding email delivery. | Recipient email address and name; the content of the notification or onboarding email. | United States |
| Brave Search | Web and news search used for topic research. | Search queries derived from your niche and topics (not your account details). | United States |
| Pexels, Pixabay and Unsplash | Stock photo and video search used to illustrate content. | Search keywords derived from your content (not your account details). | United States / EU |
2. Social platforms you connect
YouTube / Google, TikTok, Instagram and Facebook (Meta), LinkedIn, X. These are not our sub-processors: when you connect an account and publish, we send your content to that platform at your direction, and the platform handles it as an independent controller under its own terms and privacy policy.
3. Bring-your-own keys
If you add your own API key for a supported AI provider (for example OpenAI, Google, or Together) in your settings, requests that use that key go to that provider under your account and agreement with them. We store the key encrypted and use it only to make those requests on your behalf.
4. Public data sources
For trend research we read public sources such as Hacker News, Reddit, GDELT, OpenAlex, Wikipedia, Google News, and the YouTube Data API. We send only topic search terms to them, never your account or personal data.
5. Features not currently enabled
The product includes optional integrations with HeyGen (avatar video), Higgsfield, and Replicate/Together-hosted models that are not enabled in our production environment today. We will add any of them to the table above, and give notice as described below, before enabling it for customer data.
6. Changes and notice
We will give customers at least 30 days' notice by email before authorizing a new sub-processor that will process Customer Data. Customers who have a Data Processing Agreement with us may object on reasonable data-protection grounds by emailing privacy@autopostr.app within that period; if we cannot resolve the objection, they may terminate the affected service and receive a pro-rata refund of prepaid fees. To be notified of changes, email the same address to subscribe.