Sub-processors
Sub-processors
Clip Story Limited ("ClipStory") acts as a Data Processor under UK GDPR Article 28. The following sub-processors are engaged to deliver the ClipStory platform. All sub-processors are bound by Data Processing Agreements with data-protection obligations no less protective than those set out in the ClipStory DPA. This list is updated whenever a material change is made; the current version is always available at clipstory.io/policies/sub-processors.
CLOUD & HOSTING
Processor | Purpose | Data processed | Location |
Upsun / Platform.sh | Application hosting, managed PostgreSQL database, Redis cache, container orchestration | All application data and database content | UK |
VIDEO INFRASTRUCTURE
Processor | Purpose | Data processed | Location |
Cloudflare R2 | Object storage for raw video copies, brand documents (PDF/DOCX/TXT), release forms, and brand assets | Raw MP4 video files, brand documents, release forms, brand assets (logos, audio) | EU |
Cloudflare Stream | Video hosting and delivery (CDN) | Video files and streaming metadata | USA (SCCs) |
Processor | Purpose | Data processed | Location |
Postmark (ActiveCampaign) | Transactional email delivery: contributor invitations, consent confirmation, rights notifications | Recipient email address, name, email content | USA (SCCs) |
AI & TRANSCRIPTION
Processor | Purpose | Data processed | Location |
|---|---|---|---|
Deepgram, Inc. | Speech-to-text transcription of contributor video submissions | Audio and video content submitted by contributors. Processed in memory — no audio or video is retained by Deepgram beyond the transcription request, and Deepgram does not train on customer data | USA (SCCs) |
Anthropic, PBC | Clip Pilot AI features: transcript summarisation, tone analysis, script suggestions | Video transcript text (stateless — no persistent storage); no raw video or audio is sent. Anthropic does not train on customer data. | USA (SCCs) |
OpenAI, LLC | AI processing for select platform features | Transcript text and contextual metadata (stateless — no persistent storage). OpenAI does not train on customer data submitted via the API. | USA (SCCs) |
Google (Gemini) | Video intelligence analysis (visual quality, delivery and content scoring, topic extraction, b-roll/highlight detection); face position detection for auto-crop | Contributor video MP4 files (via time-limited signed URL); contributor thumbnail images; campaign context metadata. Stateless inference — no video, image or data is retained by Google beyond the API call, and Google does not train on customer data submitted via the API. | USA (SCCs) |
ANALYTICS & MONITORING
Processor | Purpose | Data processed | Location |
|---|---|---|---|
New Relic, Inc. | Application performance monitoring, error logging, infrastructure metrics | Anonymised request logs, error traces, performance metrics. No personal data is intentionally sent. | USA (SCCs) |
PAYMENTS
Processor | Purpose | Data processed | Location |
|---|---|---|---|
Stripe, Inc. | Payment processing and subscription management | Billing name, email address, payment method metadata | USA (SCCs) |
Schedule 1 — Standard Contractual Clauses & Transfer Mechanisms
All transfers to the USA are covered by the EU Standard Contractual Clauses (2021/914/EU) as adopted under the UK International Data Transfer Agreement (IDTA) issued by the ICO. Upsun processing takes place in the UK and does not require a transfer mechanism. ClipStory reviews sub-processor agreements annually and whenever a new processor is engaged.
Clip Story Limited ("ClipStory") acts as a Data Processor under UK GDPR Article 28. The following sub-processors are engaged to deliver the ClipStory platform. All sub-processors are bound by Data Processing Agreements with data-protection obligations no less protective than those set out in the ClipStory DPA. This list is updated whenever a material change is made; the current version is always available at clipstory.io/policies/sub-processors.
CLOUD & HOSTING
Processor | Purpose | Data processed | Location |
Upsun / Platform.sh | Application hosting, managed PostgreSQL database, Redis cache, container orchestration | All application data and database content | UK |
VIDEO INFRASTRUCTURE
Processor | Purpose | Data processed | Location |
Cloudflare R2 | Object storage for raw video copies, brand documents (PDF/DOCX/TXT), release forms, and brand assets | Raw MP4 video files, brand documents, release forms, brand assets (logos, audio) | EU |
Cloudflare Stream | Video hosting and delivery (CDN) | Video files and streaming metadata | USA (SCCs) |
Processor | Purpose | Data processed | Location |
Postmark (ActiveCampaign) | Transactional email delivery: contributor invitations, consent confirmation, rights notifications | Recipient email address, name, email content | USA (SCCs) |
AI & TRANSCRIPTION
Processor | Purpose | Data processed | Location |
|---|---|---|---|
Deepgram, Inc. | Speech-to-text transcription of contributor video submissions | Audio and video content submitted by contributors. Processed in memory — no audio or video is retained by Deepgram beyond the transcription request, and Deepgram does not train on customer data | USA (SCCs) |
Anthropic, PBC | Clip Pilot AI features: transcript summarisation, tone analysis, script suggestions | Video transcript text (stateless — no persistent storage); no raw video or audio is sent. Anthropic does not train on customer data. | USA (SCCs) |
OpenAI, LLC | AI processing for select platform features | Transcript text and contextual metadata (stateless — no persistent storage). OpenAI does not train on customer data submitted via the API. | USA (SCCs) |
Google (Gemini) | Video intelligence analysis (visual quality, delivery and content scoring, topic extraction, b-roll/highlight detection); face position detection for auto-crop | Contributor video MP4 files (via time-limited signed URL); contributor thumbnail images; campaign context metadata. Stateless inference — no video, image or data is retained by Google beyond the API call, and Google does not train on customer data submitted via the API. | USA (SCCs) |
ANALYTICS & MONITORING
Processor | Purpose | Data processed | Location |
|---|---|---|---|
New Relic, Inc. | Application performance monitoring, error logging, infrastructure metrics | Anonymised request logs, error traces, performance metrics. No personal data is intentionally sent. | USA (SCCs) |
PAYMENTS
Processor | Purpose | Data processed | Location |
|---|---|---|---|
Stripe, Inc. | Payment processing and subscription management | Billing name, email address, payment method metadata | USA (SCCs) |
Schedule 1 — Standard Contractual Clauses & Transfer Mechanisms
All transfers to the USA are covered by the EU Standard Contractual Clauses (2021/914/EU) as adopted under the UK International Data Transfer Agreement (IDTA) issued by the ICO. Upsun processing takes place in the UK and does not require a transfer mechanism. ClipStory reviews sub-processor agreements annually and whenever a new processor is engaged.
