Subprocessors
Every third party that touches your data
Last updated: 16 August 2026
To run Raydance.ai we rely on the providers below. This is a complete list, not a sample. Each is bound by a data processing agreement meeting Art. 28 GDPR, or acts as an independent controller where you deal with them directly.
1. Infrastructure and storage
| Provider | What it does | Data it processes | Location |
|---|---|---|---|
| Vercel | Hosts the web application and its API. Resolves your approximate location from your IP so the correct legal notices and age rules apply. | All request data in transit, coarse location (country, US state), logs. | US / EU |
| Google Analytics 4 | Optional aggregate website usage measurement, loaded only where the visitor has allowed analytics when consent is required. | Page and event data, cookie identifiers, approximate location, browser and device information. | US / EU |
| Supabase | Authentication and the primary Postgres database. | Account data, generation records, credit ledger, all application data. | EU |
| Cloudflare R2 | Object storage for generated images, uploads and avatars. | Your uploads and your generated outputs. | EU region |
| Upstash | Redis cache in front of the database. | Short-lived cached application data. | EU / US |
| Render | Runs the background worker that dispatches and monitors GPU generation jobs. | Generation job data, provider credentials. | EU / US |
2. Model execution
These providers receive your prompt, your parameters and any reference image, because a generation cannot be executed without them.
| Provider | What it does | Data it processes | Location |
|---|---|---|---|
| fal.ai | Hosted execution of image and video models. | Prompts, parameters, reference images, generated outputs. | US |
| RunPod | Rented GPU infrastructure on which we run open-source models and adapters ourselves, including those available in adult mode. | Prompts, parameters, reference images, generated outputs. | EU / US, depending on the pod region |
| OpenRouter | Routes text requests to language models for prompt enhancement and image captioning. | Prompt text and image captions. No account identifiers are sent. | US |
| abliteration.ai | Runs text models for prompt chat and reads uploaded images back as prompts on the Image to Prompt page. | Prompt text and, for image analysis, the uploaded image. No account identifiers are sent. | US |
Adult-mode prompts are executed on the same infrastructure as everything else and are transmitted to the provider running the selected model. Where a model runs on GPU infrastructure we rent, the model itself is operated by us rather than by a third party, and the provider supplies compute rather than a content service.
3. Independent controllers
These providers decide for themselves how to process the data you give them. They are not acting on our instructions, and you can exercise your rights against them directly under their own privacy policies.
| Provider | What it does | Data it processes | Location |
|---|---|---|---|
| Stripe | Takes payment and manages subscriptions. | Your payment details, billing address, transaction history. We never receive your full card number. | US / EU |
| Didit | Verifies your age where the law requires a verified check. | Your identity document, image and date of birth. We receive only the outcome — verified, pending or rejected — plus an opaque session reference. | EU |
| Google / GitHub | Identity providers, where you choose to sign in with one. | The fact that you signed in, and the email address and identifier they release to us. | US |
4. Services you connect yourself
| Provider | What it does | Data it processes | Location |
|---|---|---|---|
| Zernio | Publishes content to a social account, using an API key you supply. Nothing is sent unless you instruct it. | The content you chose to publish, and its metadata. | As stated by the provider |
We store the API keys you supply encrypted, keep only a fingerprint and the last four characters in readable form, and use them solely to carry out what you instructed. Removing the connection deletes the key.
6. Changes to this list
We update this page when a provider is added, removed or replaced, and we do it in the same release as the change rather than afterwards. Business customers who have asked to be notified of new subprocessors are told in advance and may object.
Questions about any provider on this list: info@raydance.ai.