SERVICE PROVIDERS AND SUB-PROCESSORS
Last updated: 1 October 2026
This page describes recipients involved in Web2Labs features. The Privacy Policy explains why we process data and how to exercise your rights. Inclusion here does not mean a provider receives every project or acts as a processor for every operation.
Roles and customer instructions
A processor handles personal data on a controller’s instructions. Where Web2Labs processes a customer’s content on that basis, a provider engaged for the same processing is a sub-processor. Account administration, security and billing are separate Web2Labs controller activities. Payments, connected platforms and delivery services can involve independent controllers with their own purposes and privacy duties.
For professional use involving other people’s personal data, contact [email protected] to arrange the Art. 28 GDPR agreement, the relevant processing details and authorised sub-processors before processing begins. The public list alone is not an executed processing agreement.
Content processing, hosting and delivery
| Provider/service | Function and data involved | Processing geography |
|---|---|---|
| IONOS | Application/database hosting, worker infrastructure and email delivery; account, operational and requested content data | German hosting; the applicable service contract determines support/access arrangements |
| Google Cloud Storage | Storage and delivery of uploaded media, renders, archives and other product assets | Configured bucket region; provider access can involve processing outside the EEA |
| RunPod | Transcription and specialised processing on worker infrastructure; relevant media/audio and processing artifacts | Endpoint-dependent; can include the United States |
| OpenAI | Transcript/content analysis and generation steps; prompts and relevant content excerpts | Service/endpoint-dependent; can include the United States |
| Google Gemini / Vertex AI | Visual, transcript and other content analysis; selected frames, prompts and relevant media | Service/endpoint-dependent; can include the United States |
| Anthropic | Alternative language/content analysis; prompts and relevant excerpts | Service/endpoint-dependent; can include the United States |
| xAI | Text generation and rating with Grok models for Studio projects and for several free Tools: project metadata (such as ratings, chapters, titles, descriptions, tags and thumbnail concepts), video-type recognition and, in the long-form editing mode, proposed cuts, zooms, emphasised words and short clips plus a coherence review of the edit; prompts with relevant transcript excerpts or segments, project metadata or submitted text | Service/endpoint-dependent; can include the United States |
| Cloudflare | Network edge for the website and API: content delivery, DNS, TLS termination and filtering of attacks and abusive traffic; IP address, derived location, request headers and the content of requests and responses in transit | Global edge network; requests are normally handled at a data centre near the visitor, and provider operations can involve the United States |
| ElevenLabs | Requested sound/audio generation and optional AI support assistant; generation input or support messages/voice | Can involve the United States and other provider processing locations |
| Cleanvoice | Optional audio cleanup/enhancement; audio submitted for that feature | EU provider; processing arrangements depend on its service configuration |
Only the steps used for a feature receive the relevant data. A company’s registered address does not necessarily identify where its service processes data. Ask our privacy contact for the current recipient, region and applicable safeguards for a particular processing activity.
Payments and physical orders
Stripe and PayPal process payments and receive checkout, payer, transaction and fraud-prevention information. They may act as independent controllers for payment and regulatory purposes. Web2Labs receives payment identifiers and status rather than full card credentials. Their processing can involve the EEA and other countries, including the United States.
Gelato and its fulfilment/delivery partners receive the information needed to fulfil a merchandise order, such as name, delivery address and the selected product/design. Production and delivery locations depend on the order destination. Ordering standard print-on-demand merchandise does not itself remove consumer withdrawal rights.
Connected platforms and activated embeds
Google/YouTube, Twitch, TikTok, X, Meta (Facebook/Instagram), LinkedIn, Pinterest and Vimeo receive data when the relevant connection, publishing action or supported player is used. Authorised channel analysis can run periodically while connected. These platforms operate their own services under their own privacy notices and can process data internationally; they are not all Web2Labs sub-processors.
Discord receives role and announcement updates only for members who link a Discord account. We store the linked Discord user ID, assign Web2Labs-managed roles on the Web2Labs Discord server that reflect the membership plan and leaderboard league, and may announce league promotions there with the Web2Labs username. Server members can see these roles and announcements. Discord operates its platform as an independent controller; unlinking stops future updates and removes the managed roles.
If you enable browser notifications, the push service operated by your browser's vendor (for example Google, Mozilla or Apple) delivers them. The notification content is encrypted for your browser; the push service handles the delivery address and timing.
YouTube and Twitch players load only when selected. The ElevenLabs support assistant loads only after separate activation. See the Cookie Policy for activation, withdrawal and browser storage.
Operations and public information
Operational messaging can involve Telegram where configured for internal alerts. Internal use does not make any personal data in an alert anonymous. Alerts must minimise customer information and exclude credentials or unnecessary uploaded content.
Apify and Oxylabs support collection of public creator/market information where used. Public profile names, handles and statistics may still be personal data. Public availability does not remove transparency, lawful-basis or retention obligations. These research services are separate from the Studio upload-processing pipeline.
Transfers and provider changes
Providers acting on instructions require an agreement meeting Art. 28 GDPR. Routine international transfers requiring a safeguard must have applicable Chapter V GDPR coverage. Depending on the actual recipient and processing, this can be an adequacy decision or the European Commission’s Standard Contractual Clauses with necessary supplementary measures. An EU-US Data Privacy Framework claim requires active certification covering the recipient and service. Listing a brand is not proof of that coverage.
To request information or a copy/description of applicable safeguards, receive provider-change information, or object under your customer processing agreement, email [email protected]. The agreement must establish the applicable notice and objection procedure; this page does not silently authorise a new provider on a customer’s behalf.