Subprocessors

Vercel

• Services provided: Application hosting, infrastructure, and image storage and delivery through Vercel Blob
• Data processed: Application data, request data, metadata, and user-uploaded profile images (avatars) and campaign covers
• Processing location: Application hosting in Germany (EU region); Blob storage in Frankfurt, Germany (fra1, EU); image caching and delivery through a global CDN
• International transfer safeguards: Standard Contractual Clauses or other applicable mechanisms as described in Vercel’s Data Processing Addendum

Vercel hosts and runs clipledger. Vercel Blob stores and delivers uploaded avatars and campaign covers. These images are stored in a public Blob store: anyone with an image URL can access it without signing in. Uploading, replacing and deleting images require authorization in clipledger.

Resend

• Service provided: Transactional email delivery
• Data processed: Email addresses and notification content
• Processing location: United States (where applicable)
• International transfer safeguard: Standard Contractual Clauses or other appropriate safeguards

Resend is used to send transactional emails such as invitations and account notifications.

Upstash

• Service provided: Rate limiting and caching infrastructure (Redis)
• Data processed: IP addresses and technical request identifiers used solely for abuse prevention and rate limiting
• Processing location: Germany (Frankfurt, EU region - eu-central-1)
• International transfer safeguard: Not applicable (EEA processing)

Upstash is used for request rate limiting and abuse prevention.

Database (Neon)

• Service provided: Database hosting (serverless PostgreSQL)
• Data processed: All application data including user accounts, campaign data, and related metadata
• Processing location: Germany (Frankfurt, EU region)
• International transfer safeguard: Not applicable (EEA processing)

Neon is used to store and manage the primary application database.

Google

• Services provided: Authentication (Google OAuth) and YouTube API access
• Data processed: Authentication identifiers, account email addresses, and publicly available video metadata
• Processing location: Global infrastructure operated by Google
• International transfer safeguard: Standard Contractual Clauses or other appropriate safeguards

Google services are used for secure user authentication and for retrieving public YouTube video statistics.

Meta (Facebook and Instagram)

• Services provided: Authentication (Facebook Login) and Instagram Graph API access
• Data processed: Account identifiers, basic profile information, and media performance metrics (such as video views and insights)
• Processing location: Global infrastructure operated by Meta
• International transfer safeguard: Standard Contractual Clauses or other appropriate safeguards

Meta services are used for user authentication and for retrieving Instagram account data and media performance metrics.

TikTok

• Services provided: API access for retrieving basic profile information and the authenticated user's own video data
• Data processed: Account identifiers, display name, profile picture, video identifiers, and video performance metrics (such as view counts)
• Processing location: Global infrastructure operated by TikTok
• International transfer safeguard: Standard Contractual Clauses or other appropriate safeguards

TikTok services are used to retrieve basic profile information when users connect their accounts.