Sub-processors
Sub- processors
Effective April 24, 2026
socialAF uses the following third-party vendors that may process personal data as part of the Character Studio service. We contractually require appropriate privacy and security safeguards and update this list as the service evolves.
Current sub-processors
| Vendor | Purpose | Data | Region |
|---|---|---|---|
| DigitalOcean | Application hosting and infrastructure | IP addresses, operational logs | USA |
| Cloudflare | CDN, DDoS mitigation, bot management, and CSAM scanning at the edge | IP addresses, request metadata, image content (for CSAM hash scan) | Global edge |
| MongoDB Atlas | Primary database for accounts, subscriptions, audit logs | Account profile, subscription state, moderation events | USA |
| Cloudflare R2 | Object storage for user-uploaded references and generated media | Reference images, generated images, thumbnails, content hashes | Global edge |
| PixelDojo | Model-inference router for image, video, avatar, and TTS generation | Prompts, reference images, generation metadata | USA |
| Replicate | Hosted minor-detection classifier (image safety layer) | Image bytes for classification; no retention beyond the request | USA |
| OpenAI | Prompt-safety AI classifier (text safety layer) | Text prompts submitted to the AI safety layer | USA |
| Whop | Payment processing and subscription management (merchant of record) | Billing email, subscription status, order / receipt metadata | USA |
| Better-Auth / Google OAuth | Authentication and session management | Email, hashed password, OAuth profile metadata | USA |
| Brevo | Transactional email | Email address, transactional message content | EU |
Updates to this list
We may add new sub-processors to support product changes. Material changes will be communicated where required by law or contract. This page always reflects the current list.
Contact
Questions about sub-processors can be sent to [email protected].