Sub-processors
Language notice
This page is provided in Greek for your convenience and readability. In the event of any conflict or discrepancy between the Greek and English versions, the English version is the legally binding text.
We use the third-party services below to provide and operate film.mystage.ai. Each is bound by a Data Processing Agreement and an approved basis for any transfer of data outside the EEA.
Draft — pending legal review
| Provider | Purpose | Data shared | Region | Transfer basis | DPA |
|---|---|---|---|---|---|
| Cloudflare R2 | Storage of all customer binary assets (uploads, generated images/clips/videos). | Uploaded photos/audio (may contain likeness), generated media. | EU | Adequacy (EU) | View DPA |
| Customer.io | Sending transactional and lifecycle email (contact, export-ready, erasure confirmation). | Email address, message content/metadata. | EU | DPF | View DPA |
| ElevenLabs | Text-to-speech / voice cloning (eleven_multilingual_v2) for Greek + English narration. | Voice sample (biometric), generated audio. | US | DPF | View DPA |
| fal.ai | Image-to-video clip generation (Seedance REST fallback + Kling 3 i2v via fal.ai proxy). fal.ai acts as GDPR-compliant proxy for Kling by Kuaishou (China) — direct Kling API is prohibited. | Start image (may contain likeness), generated clips, customer avatar image (for i2v animation). | US | SCC | View DPA |
| HeyGen | Talking-head avatar video rendering using pre-built HeyGen avatars. No customer biometric upload to HeyGen in current scope. | Avatar video output (contains customer-selected avatar likeness); rendered video URLs. | US | SCC | View DPA |
| Higgsfield | Image-to-video clip generation (Seedance via MCP/OAuth, subscription-billed). | Start image (may contain likeness), generated clips. | US | SCC | View DPA |
| OpenAI | Image generation (GPT Image 2) for avatar-in-property and hook images. | Prompt text, reference/uploaded images. | US | SCC | View DPA |
| Stripe | Payment processing and billing. | Email, billing details, payment card metadata (Stripe-tokenised; we store no PAN). | US | DPF | View DPA |
| Supabase | Primary application database and authentication (in-EU, Frankfurt). | Account email, profile, orders, consent records, application data. | EU | Adequacy (EU) | View DPA |
| sync.so | Lipsync (lipsync-2-pro) � applies Greek/English audio onto the talking clip. | Avatar clip (likeness), audio, generated lipsync output. | US | SCC | View DPA |
| Trigger.dev | Durable orchestration of the video pipeline and the erasure cascade. | IDs-only run payloads (the IDs-only D-07 pattern is the no-PII mitigation). | US | SCC | View DPA |
| Vercel | Hosting and serving the Next.js application (compute + edge network). | HTTP request metadata, IP addresses, application logs. | US | DPF | View DPA |
Last updated 29 Jun 2026.
Note: the EU–US Data Privacy Framework (DPF) adequacy decision relied on for some US transfers is subject to a pending appeal before the Court of Justice of the European Union; we monitor this and will update the bases above if it changes.
Note: Stripe processing also includes Stripe Connect Express accounts used to pay referral commissions to customers who opt in to our invite-a-friend program — Stripe holds the payee's name and bank details for that payout; we never see or store them.