Subprocessors
Last updated: 2026-08-12Version 1.0
GravitonForge Technologies Ltd uses the third-party providers below to deliver Voiceora. Each processes personal data on our instructions under a written data processing agreement.
We will update this page before engaging a new subprocessor. To be notified of changes, email support@voiceora.io.
Current subprocessors
| Provider | Purpose | Personal data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Supabase | Authentication, database, file storage | Account data, brand voice samples, submitted content, generated outputs, usage records | United Kingdom — London (eu-west-2) | None required — no restricted transfer |
| Vercel Inc. | Application hosting, content delivery, edge network; Web Analytics (aggregate usage statistics); Speed Insights (page performance measurement) | IP address, request metadata, all data in transit; pseudonymous page and performance events | United States and global edge locations | UK Addendum to EU SCCs |
| Stripe, Inc. / Stripe Payments Europe Ltd | Payment processing, subscription billing, invoicing | Name, email, billing address, country, card data (held by Stripe, not by us), transaction history | United States, EU, UK | UK Addendum to EU SCCs |
| OpenRouter, Inc. | Routing of AI generation requests | Content submitted for generation, including text, images and (when enabled) video | United States | UK Addendum to EU SCCs |
| DeepInfra, Inc. | AI model inference (Qwen open-weight models) | Content submitted for generation | United States | UK Addendum to EU SCCs |
| Functional Software, Inc. (Sentry) | Application error monitoring and diagnostics | IP address, browser and device data, error context, user identifier | European Union | None required — no restricted transfer |
| Google LLC (Google Workspace) | Business email, support correspondence | Any personal data contained in correspondence with us | EU / UK | Google Cloud Data Processing Addendum |
Infrastructure providers
Some of the above rely on their own infrastructure providers. We do not contract with these directly.
| Provider | Used by |
|---|---|
| Amazon Web Services | Supabase, Vercel, Sentry |
Notes on AI processing
Content you submit for generation is routed only to DeepInfra. This restriction is enforced in our application code by a fixed provider allowlist rather than a configurable setting, so it cannot be changed by a deployment configuration error.
Retention and training. OpenRouter's published policy states that it does not store prompts or responses unless prompt logging is enabled on the account; we keep it disabled, and we do not permit routing to providers that train on submitted data. DeepInfra's published policy states that it will not store, sell or train on API inputs and outputs without explicit consent, but that it may occasionally retain inputs and outputs for a limited period for debugging. DeepInfra holds SOC 2 and ISO 27001 certification and has a named Data Protection Officer.