List of sub-processors
Last updated:
This page names the entities WebImpact entrusts with processing data in connection with providing the service, together with the purpose of processing, the place of processing and the basis for any transfer outside the European Economic Area.
1. What this list is
Below we list the entities we entrust with processing data in connection with providing the WebImpact AI Marketing Studio service. This list is also an annex to the data processing agreement (DPA) concluded with the Client, and it discharges the duty to inform about sub-processors under Art. 28(2) GDPR.
The split of roles is described in the Privacy Policy (page /en/privacy). In short: for account data and platform usage data, WebImpact is the controller; for data the Client enters in its own workspace about its customers or staff, the Client is the controller and WebImpact processes it as a processor.
This list is generated from the provider registry the application itself uses, rather than maintained by hand - so it cannot describe a provider we no longer call, nor omit a newly added one.
2. AI model providers
These providers receive the material submitted for a generation. They do not receive sign-in data, nor any Asset Library content beyond the material designated for that particular generation.
| Provider | What we use it for and what we send | Where it processes | Basis for transfer outside the EEA |
|---|---|---|---|
| fal.ai | generating and editing images; generating video; generating 3D models; speech synthesis and recognition (voice-over, subtitles, dubbing). What we send: images and reference files uploaded by the user, plus the prompt; the starting frame, a photograph or an uploaded video together with its audio track (including the likeness and voice of people the user uploaded), plus the prompt; the photograph of the object to be modelled; the recording or the text to be read out, and the selected voice. | United States | (to be confirmed by WebImpact) |
| Anthropic | generating and editing copy (articles, emails, descriptions, captions). What we send: the prompt, the brief and the company context - including whatever the user typed in. | United States | (to be confirmed by WebImpact) |
| generating and editing images; generating video; generating and editing copy (articles, emails, descriptions, captions). What we send: images and reference files uploaded by the user, plus the prompt; the starting frame, a photograph or an uploaded video together with its audio track (including the likeness and voice of people the user uploaded), plus the prompt; the prompt, the brief and the company context - including whatever the user typed in. | United States | (to be confirmed by WebImpact) | |
| ElevenLabs | speech synthesis and recognition (voice-over, subtitles, dubbing). What we send: the recording or the text to be read out, and the selected voice. | United States | (to be confirmed by WebImpact) |
| Bright Data | fetching publicly available content from an indicated website. What we send: the website address indicated by the user (no data from the panel). | Israel | (to be confirmed by WebImpact) |
| BRIA AI | generating and editing images. What we send: images and reference files uploaded by the user, plus the prompt. | (to be confirmed by WebImpact) | (to be confirmed by WebImpact) |
| ByteDance (BytePlus) | generating video. What we send: the starting frame, a photograph or an uploaded video together with its audio track (including the likeness and voice of people the user uploaded), plus the prompt. | (to be confirmed by WebImpact) | (to be confirmed by WebImpact) |
| Kuaishou (KlingAI) | generating video. What we send: the starting frame, a photograph or an uploaded video together with its audio track (including the likeness and voice of people the user uploaded), plus the prompt. | (to be confirmed by WebImpact) | (to be confirmed by WebImpact) |
| Sync | generating video. What we send: the starting frame, a photograph or an uploaded video together with its audio track (including the likeness and voice of people the user uploaded), plus the prompt. | (to be confirmed by WebImpact) | (to be confirmed by WebImpact) |
| MiniMax | generating video. What we send: the starting frame, a photograph or an uploaded video together with its audio track (including the likeness and voice of people the user uploaded), plus the prompt. | (to be confirmed by WebImpact) | (to be confirmed by WebImpact) |
| ClarityAI | generating and editing images. What we send: images and reference files uploaded by the user, plus the prompt. | (to be confirmed by WebImpact) | (to be confirmed by WebImpact) |
| OpenAI | generating and editing images. What we send: images and reference files uploaded by the user, plus the prompt. | United States | (to be confirmed by WebImpact) |
3. Platform infrastructure and tooling
| Provider | What we use it for and what we send | Where it processes | Basis for transfer outside the EEA |
|---|---|---|---|
| Supabase | authentication and identity management for users, and durable storage of files uploaded to and generated in the panel. What we send: email address and sign-in data; all Asset Library files. | (to be confirmed by WebImpact) | (to be confirmed by WebImpact) |
| Fly.io | application hosting and the platform database. What we send: all data processed in the panel. | Frankfurt, Germany (EEA) - region of the machines and the database | (to be confirmed by WebImpact) |
| Resend | delivery of transactional messages and notifications sent by WebImpact. What we send: the recipient's email address and the notification content. | United States | EU-U.S. Data Privacy Framework - adequacy decision (Art. 45 GDPR). |
| Sentry | error and reliability monitoring for the platform. What we send: technical error data; personal data is filtered out before it is sent. | European Union (the provider's EU region) | (to be confirmed by WebImpact) |
| Cloudflare | DNS, attack protection and content delivery for the platform domain. What we send: IP address and HTTP request metadata. | (to be confirmed by WebImpact) | (to be confirmed by WebImpact) |
4. Prepared providers - inactive today
We list them for completeness: these are the owners of models we currently order through an intermediary. The platform has NO active connection through which it could send them data (no credentials or no adapter yet), and no data reaches them. Before any of these routes is switched on, we will complete this list and notify Clients as described below.
| Provider | What we use it for and what we send | Where it processes | Basis for transfer outside the EEA |
|---|---|---|---|
| ByteDance (BytePlus Vision AI) | generating video. What we send: the starting frame, a photograph or an uploaded video together with its audio track (including the likeness and voice of people the user uploaded), plus the prompt. | (to be confirmed by WebImpact) | (to be confirmed by WebImpact) |
| Deemos (Hyper3D) | generating 3D models. What we send: the photograph of the object to be modelled. | (to be confirmed by WebImpact) | (to be confirmed by WebImpact) |
5. Who is not on this list, and why
- The service where we track bug reports. A client's report is NOT sent there: only our own description of the problem and a link back to the panel leave our systems - the report body, the company name, the author and any attachments stay with us. The code that builds such an issue structurally refuses to accept that data.
- The social platforms we publish to on the Client's behalf. A publication goes to the CLIENT's own profile, on the Client's instruction and under the Client's own agreement with that platform - the platform is a separate controller there, not our subcontractor.
- The Client's bulk email provider. A newsletter is sent using the CLIENT's own key from the Client's own account, so that provider is the Client's processor, not our sub-processor. We do not store recipient lists.
- The Client's ERP system and website. These are the Client's own systems; the ERP integration is read-only, and publication to the website happens on the Client's instruction.
6. Changes to this list
We give the Client at least 30 days' notice of any intention to add a new sub-processor or replace an existing one, by updating this page and sending notice to the Client's contact address. During that period the Client may raise a reasoned objection, on the terms set out in the data processing agreement.
Entries marked „(to be confirmed by WebImpact)” are facts we do not want to state from memory - we complete them on the basis of documents received from the provider. Until then, information about the safeguards applied to a particular transfer is available on request.
7. Contact
Questions about this list, about the data processing agreement, or about the safeguards for a particular transfer: [email protected].