List of sub-processors
Last updated:
This page names the entities WebImpact entrusts with processing data in connection with providing the service, together with the purpose of processing, the place of processing and the basis for any transfer outside the European Economic Area.
1. What this list is
Below we list the entities we entrust with processing data in connection with providing the WebImpact AI Marketing Studio service. This list is also an annex to the data processing agreement (DPA) concluded with the Client, and it discharges the duty to inform about sub-processors under Art. 28(2) GDPR.
The split of roles is described in the Privacy Policy (page /en/privacy). In short: for account data and platform usage data, WebImpact is the controller; for data the Client enters in its own workspace about its customers or staff, the Client is the controller and WebImpact processes it as a processor.
We generate the AI model providers and model owners from the provider registry the application itself uses, rather than maintaining them by hand; an automated check in our code verifies that every model we order through fal.ai has an owner in that registry or a recorded reason why it does not. The platform infrastructure and tooling section is maintained by hand.
Some models are ordered through an intermediary - fal.ai. We list the owners of those models in a separate section, as further parties the request may reach.
2. AI model providers
These providers receive directly from us the material submitted for a generation or for its analysis. They do not receive sign-in data, nor any Asset Library content beyond the material designated for that particular generation.
| Provider | What we use it for and what we send | Where it processes | Basis for transfer outside the EEA |
|---|---|---|---|
| fal.ai | generating and editing images; generating video; generating 3D models; composing a music track for video material. What we send: images and reference files uploaded by the user, plus the prompt; the starting frame, a photograph or an uploaded video together with its audio track (including the likeness and voice of people the user uploaded), plus the prompt; the photograph of the object to be modelled; the video clip together with its audio track (including the likeness and voice of people the user uploaded), plus a description of the music style. | United States | EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). The provider's agreement (version of 2026-07-31) contains only Module 2; Module 3 (processor to sub-processor) is not in it; WebImpact is requesting that it be added. |
| Anthropic | generating and editing copy (articles, emails, descriptions, captions); analysing images, video frames and transcripts of recordings for generation (describing the scene, reviewing quality, guiding the generator). What we send: the prompt, the brief and the company context - including whatever the user typed in; photographs and graphics passed for image analysis (including the likeness of people shown in photographs the user uploaded); individual frames taken from video material (including the likeness of people); the transcript of recorded speech (subtitles and dubbing). | United States | EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). |
| generating and editing images; generating and editing copy (articles, emails, descriptions, captions); analysing images, video frames and video clips for generation (describing the scene, reviewing quality, guiding the generator). What we send: images and reference files uploaded by the user, plus the prompt; the prompt, the brief and the company context - including whatever the user typed in; photographs and graphics passed for image analysis (including the likeness of people shown in photographs the user uploaded); individual frames taken from video material (including the likeness of people); finished video clips passed for quality review, together with their audio track (including the likeness and voice of people, where present). | United States | EU-U.S. Data Privacy Framework - adequacy decision (Art. 45 GDPR). | |
| ElevenLabs | speech synthesis and recognition (voice-over, subtitles, dubbing). What we send: the recording or the text to be read out, and the selected voice. | United States | EU-U.S. Data Privacy Framework - adequacy decision (Art. 45 GDPR). |
| Bright Data | fetching publicly available content from an indicated website. What we send: the website address indicated by the user (no data from the panel). | Israel (Bright Data Ltd., Netanya) | European Commission adequacy decision (Art. 45 GDPR). |
3. Model owners fal.ai may pass requests to
When a request goes through fal.ai and the model belongs to another company, fal.ai passes the request on to the owner of the model; for models fal.ai may run itself, the row says “may pass on”. fal.ai does not list model owners on its own sub-processor list; we are establishing their status, and the basis for that transfer, with fal.ai.
fal.ai is also the fallback route for providers the platform has its own connection with: while that connection is closed (the conditions for opening it are described under “Changes to this list”) or when it fails, requests to their models are handled by fal.ai.
| Provider | What we use it for and what we send | Where it processes | Basis for transfer outside the EEA |
|---|---|---|---|
| generating and editing images; generating video. fal.ai passes on: images and reference files uploaded by the user, plus the prompt; the starting frame, a photograph or an uploaded video together with its audio track (including the likeness and voice of people the user uploaded), plus the prompt. | According to the provider's documents for its own API: United States | Transferred through fal.ai; basis for the transfer from fal.ai to the model owner: (to be confirmed by WebImpact). | |
| BRIA AI | generating and editing images. fal.ai may pass on: images and reference files uploaded by the user, plus the prompt. | (to be confirmed by WebImpact) | Transferred through fal.ai; basis for the transfer from fal.ai to the model owner: (to be confirmed by WebImpact). |
| ByteDance (BytePlus) | generating video. fal.ai passes on: the starting frame, a photograph or an uploaded video together with its audio track (including the likeness and voice of people the user uploaded), plus the prompt. | According to the provider's documents for its own API: Singapore (BytePlus Pte. Ltd.); processing in Malaysia, Indonesia or the EU/EEA | Transferred through fal.ai; basis for the transfer from fal.ai to the model owner: (to be confirmed by WebImpact). |
| Kuaishou (KlingAI) | generating video. fal.ai passes on: the starting frame, a photograph or an uploaded video together with its audio track (including the likeness and voice of people the user uploaded), plus the prompt. | According to the provider's documents for its own API: Singapore (Kling AI Pte. Ltd.) | Transferred through fal.ai; basis for the transfer from fal.ai to the model owner: (to be confirmed by WebImpact). |
| Sync | generating video. fal.ai passes on: the starting frame, a photograph or an uploaded video together with its audio track (including the likeness and voice of people the user uploaded), plus the prompt. | (to be confirmed by WebImpact) | Transferred through fal.ai; basis for the transfer from fal.ai to the model owner: (to be confirmed by WebImpact). |
| ByteDance (BytePlus Vision AI) | generating video. fal.ai passes on: the starting frame, a photograph or an uploaded video together with its audio track (including the likeness and voice of people the user uploaded), plus the prompt. | According to the provider's documents for its own API: Singapore (BytePlus Pte. Ltd., region ap-singapore-1) | Transferred through fal.ai; basis for the transfer from fal.ai to the model owner: (to be confirmed by WebImpact). |
| MiniMax | generating video. fal.ai passes on: the starting frame, a photograph or an uploaded video together with its audio track (including the likeness and voice of people the user uploaded), plus the prompt. | According to the provider's documents for its own API: Singapore (Nanonoble Pte. Ltd.); data stored in the United States | Transferred through fal.ai; basis for the transfer from fal.ai to the model owner: (to be confirmed by WebImpact). |
| ClarityAI | generating and editing images. fal.ai may pass on: images and reference files uploaded by the user, plus the prompt. | (to be confirmed by WebImpact) | Transferred through fal.ai; basis for the transfer from fal.ai to the model owner: (to be confirmed by WebImpact). |
| Deemos (Hyper3D) | generating 3D models. fal.ai passes on: the photograph of the object to be modelled. | (to be confirmed by WebImpact) | Transferred through fal.ai; basis for the transfer from fal.ai to the model owner: (to be confirmed by WebImpact). |
| Sonilo | composing a music track for video material. fal.ai may pass on: the video clip together with its audio track (including the likeness and voice of people the user uploaded), plus a description of the music style. | (to be confirmed by WebImpact) | Transferred through fal.ai; basis for the transfer from fal.ai to the model owner: (to be confirmed by WebImpact). |
| OpenAI | generating and editing images. fal.ai passes on: images and reference files uploaded by the user, plus the prompt. | (to be confirmed by WebImpact) | Transferred through fal.ai; basis for the transfer from fal.ai to the model owner: (to be confirmed by WebImpact). |
4. Platform infrastructure and tooling
| Provider | What we use it for and what we send | Where it processes | Basis for transfer outside the EEA |
|---|---|---|---|
| Supabase | authentication and identity management for users, and durable storage of files uploaded to and generated in the panel. What we send: email address and sign-in data; all Asset Library files. | (to be confirmed by WebImpact) | EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). |
| Fly.io | application hosting and the platform database. What we send: all data processed in the panel. | Frankfurt, Germany (EEA) - region of the machines and the database | EU-U.S. Data Privacy Framework - adequacy decision (Art. 45 GDPR). |
| Resend | delivery of transactional messages and notifications sent by WebImpact. What we send: the recipient's email address and the notification content. | United States | EU-U.S. Data Privacy Framework - adequacy decision (Art. 45 GDPR). Registry status: re-certification under review. |
| Sentry | error and reliability monitoring for the platform. What we send: technical error data; personal data is filtered out before it is sent. | European Union (the provider's EU region) | EU-U.S. Data Privacy Framework - adequacy decision (Art. 45 GDPR). |
| Cloudflare | DNS, attack protection and content delivery for the platform domain. What we send: IP address and HTTP request metadata. | (to be confirmed by WebImpact) | EU-U.S. Data Privacy Framework - adequacy decision (Art. 45 GDPR). Registry status: re-certification under review. |
5. Who is not on this list, and why
- The service where we track bug reports. A client's report is NOT sent there: only our own description of the problem and a link back to the panel leave our systems - the report body, the company name, the author and any attachments stay with us. The code that builds such an issue structurally refuses to accept that data.
- The social platforms we publish to on the Client's behalf. A publication goes to the CLIENT's own profile, on the Client's instruction and under the Client's own agreement with that platform - the platform is a separate controller there, not our subcontractor.
- The Client's bulk email provider. A newsletter is sent using the CLIENT's own key from the Client's own account, so that provider is the Client's processor, not our sub-processor. We do not store recipient lists.
- The Client's ERP system, online shop and website. These are the Client's own systems: we read the product catalogue from the ERP and the shop, and write to them only what the Client instructs us to publish (for example a blog post in its own shop); publication to the website likewise happens on the Client's instruction.
6. Changes to this list
We give the Client at least 30 days' notice of any intention to add a new sub-processor or replace an existing one, by updating this page and sending notice to the Client's contact address. During that period the Client may raise a reasoned objection, on the terms set out in the data processing agreement.
Adding a provider's credentials to the platform does not switch anything on by itself: direct transfers to a new provider open only once we have a data processing agreement with it, an established basis for the transfer outside the EEA and - where required - a transfer impact assessment, and at least 30 days have passed since Clients were notified.
Entries marked “(to be confirmed by WebImpact)” are facts we do not want to state from memory - we complete them on the basis of documents received from the provider. Until then, information about the safeguards applied to a particular transfer is available on request.
7. Contact
Questions about this list, about the data processing agreement, or about the safeguards for a particular transfer: [email protected].