Subprocessors
Last updated: 2026-09-08
The service providers that process personal data on behalf of uplads. This page is Annex 4 of our data processing agreement.
The processor informs the controller in advance, by email to the address held in the uplads account, of any intended addition or replacement of a subprocessor. The controller may object within two weeks on important data protection grounds (Section 8(2) and (3) of the agreement).
Subprocessors
These providers process personal data on our behalf.
| Name | Function | Location and transfer |
|---|---|---|
| Hetzner Online GmbH | Server hosting for the application, background workers and the job queue | EU (Germany, Falkenstein) |
| Supabase, Inc. | Database, authentication and file storage | EU (Ireland, eu-west-1), parent company in the USA. EU standard contractual clauses under Art. 46(2)(c) GDPR are in place. |
| Cloudflare, Inc. | Object storage (R2) for uploaded creatives, CDN, DNS and attack protection | USA. EU standard contractual clauses under Art. 46(2)(c) GDPR are in place and a DPF certification exists. |
| Anthropic PBC | AI model/API for ad copy, image analysis and the optimizer, when the AI is billed by uplads | USA. EU standard contractual clauses under Art. 46(2)(c) GDPR are in place. API data is not used to train the models. |
| OpenAI Ireland Ltd. | AI model/API for ad copy, image analysis and transcription of the audio track of uploaded videos, when the AI is billed by uplads | Ireland / USA. EU standard contractual clauses under Art. 46(2)(c) GDPR are in place. API data is not used to train the models. |
| Stripe Payments Europe, Ltd. | Payment processing and subscription management | Ireland / USA. EU standard contractual clauses under Art. 46(2)(c) GDPR are in place and a DPF certification exists. |
| PostHog, Inc. | Product analytics and session replay of the uplads interface | EU cloud (Germany), parent company in the USA. EU standard contractual clauses under Art. 46(2)(c) GDPR are in place. |
| Chatwoot Inc. | Support live chat in the application and on the website | USA. EU standard contractual clauses under Art. 46(2)(c) GDPR are in place. |
| Plus Five Five, Inc. (Resend) | Delivery of system and notification emails | USA. EU standard contractual clauses under Art. 46(2)(c) GDPR are in place. |
OpenAI and Anthropic act as subprocessors only in so far as the use of the AI features is billed through the processor. If the controller stores its own API key for a provider, the processing concerned takes place on the basis of the contractual relationship between the controller and that provider, which is then the controller's own processor for it. Stored keys are held encrypted and are not returned to the controller's browser.
Recipients acting on your instructions
Advertising platforms the controller connects its own account to. They are not subprocessors of the processor: data is transmitted to them only on the controller's instructions, and that processing is governed by the contractual relationship between the controller and the platform concerned.
| Name | Function | Location and transfer |
|---|---|---|
| Meta Platforms Ireland Ltd. | The controller's Facebook and Instagram ad accounts | Ireland / USA |
| Google Ireland Ltd. | The controller's Google Ads and YouTube accounts | Ireland / USA |
| TikTok Technology Ltd. | The controller's TikTok ad accounts | Ireland |
| Snap Group Ltd. | The controller's Snapchat ad accounts | United Kingdom / USA |
| LinkedIn Ireland Unlimited Company | The controller's LinkedIn ad accounts | Ireland / USA |
Optional integrations
Used only where the controller connects them explicitly.
| Name | Function | Location and transfer |
|---|---|---|
| Dropbox International Unlimited Company | Importing creatives from the controller's Dropbox account | Ireland / USA |
| Google Ireland Ltd. (Drive) | Importing creatives from the controller's Google Drive | Ireland / USA |
| Slack Technologies Ltd. | Notifications into the controller's Slack workspace | Ireland / USA |
| ClickUp (Mango Technologies, Inc.) | Tasks in the controller's ClickUp workspace | USA |