Sub-processors

Last updated: 2026-10-20 · Version 1.1

These third parties process personal data on DemoScreen's behalf to deliver the service. Each entry lists what they do, what categories of data they see, where the data resides, and the transfer safeguard we rely on under GDPR Chapter V.

We notify active accounts by email at least 30 days before a new sub-processor goes live, and post the change to this page. If you object, you can terminate your account during the notice window with a pro-rata refund for the unused portion of a paid plan.

Contabo GmbH

purpose: Application server, Postgres database, render workers (Playwright, Kokoro TTS, ffmpeg)
data seen: Account profiles, projects, render metadata, audit logs
location: Düsseldorf, Germany (EU)
transfer safeguard: EU controller; no transfer outside EEA

Cloudflare R2

purpose: Object storage for project assets, render outputs (MP4 + SRT), encrypted DB backups
data seen: Screenshot uploads, generated MP4 + SRT bundles, age-encrypted Postgres dumps
location: EU jurisdiction
transfer safeguard: EU SCCs; data at rest in EU jurisdiction

Cloudflare Workers

purpose: Static site hosting + asset delivery for demoscreen.co
data seen: No personal data — static HTML/CSS/JS only; request IPs visible in CF logs
location: Global edge, account billed to EU entity
transfer safeguard: EU SCCs

Google LLC (Firebase Authentication)

purpose: Sign-in (Google OAuth)
data seen: Email address, sign-in timestamps
location: United States
transfer safeguard: EU SCCs + EU-US Data Privacy Framework certification

Stripe Payments Europe Ltd. / Stripe Inc.

purpose: Pro subscription billing and invoicing
data seen: Email, billing name + address, card-tail, country, transaction history
location: Ireland (EU) + United States (parent)
transfer safeguard: EU SCCs

Scaleway SAS

purpose: Transactional email delivery; AI text generation (Generative APIs): the script draft, the scenes plan and content checks
data seen: Email: recipient email, subject, message-id, delivery status. AI: outline and script text, text read from your screenshots and, for the script draft, short-lived links to the screenshots themselves
location: Paris, France (EU), fr-par
transfer safeguard: EU processor; infrastructure in France. AI prompts are not retained by default or used for training (Scaleway may keep a failing request up to 14 days to investigate it)

ElevenLabs, Inc.

purpose: Text-to-speech for premium Pro voices and on-demand music generation during renders
data seen: Voiceover script text and music prompt text for Pro renders. Never screenshots, never account data.
location: United States
transfer safeguard: EU Standard Contractual Clauses + EU-US Data Privacy Framework; per-render payloads only, not retained by DemoScreen after the response

Privacy notice: /privacy. DPA: /legal/dpa.