Sub-processors

Last updated: 2026-05-18 · Version 1.0

These third parties process personal data on DemoScreen's behalf to deliver the service. Each entry lists what they do, what categories of data they see, where the data resides, and the transfer safeguard we rely on under GDPR Chapter V.

We notify active accounts by email at least 30 days before a new sub-processor goes live, and post the change to this page. If you object, you can terminate your account during the notice window with a pro-rata refund for the unused portion of a paid plan.

Contabo GmbH

purpose: Application server, Postgres database, render workers (Playwright, Kokoro TTS, ffmpeg)
data seen: Account profiles, projects, render metadata, audit logs
location: Düsseldorf, Germany (EU)
transfer safeguard: EU controller; no transfer outside EEA

Cloudflare R2

purpose: Object storage for project assets, render outputs (MP4 + SRT), encrypted DB backups
data seen: Screenshot uploads, generated MP4 + SRT bundles, age-encrypted Postgres dumps
location: EU jurisdiction
transfer safeguard: EU SCCs; data at rest in EU jurisdiction

Cloudflare Workers

purpose: Static site hosting + asset delivery for demoscreen.co
data seen: No personal data — static HTML/CSS/JS only; request IPs visible in CF logs
location: Global edge, account billed to EU entity
transfer safeguard: EU SCCs

Google LLC (Firebase Authentication)

purpose: Sign-in (Google OAuth)
data seen: Email address, sign-in timestamps
location: United States
transfer safeguard: EU SCCs + EU-US Data Privacy Framework certification

Stripe Payments Europe Ltd. / Stripe Inc.

purpose: Pro subscription billing and invoicing
data seen: Email, billing name + address, card-tail, country, transaction history
location: Ireland (EU) + United States (parent)
transfer safeguard: EU SCCs

Resend

purpose: Transactional + marketing email delivery
data seen: Recipient email, subject, message-id, delivery status
location: EU region (eu-west-1)
transfer safeguard: EU SCCs where applicable

ElevenLabs, Inc.

purpose: Text-to-speech for premium Pro voices and on-demand music generation during renders
data seen: Voiceover script text and music prompt text for Pro renders. Never screenshots, never account data.
location: United States
transfer safeguard: EU Standard Contractual Clauses + EU-US Data Privacy Framework; per-render payloads only, not retained by DemoScreen after the response

DeepSeek (Hangzhou DeepSeek AI Co., Ltd.)

purpose: Large-language-model rewrite of the project outline into a scenes plan for the renderer
data seen: Outline text and per-scene copy snippets. Screenshots are never sent to the LLM.
location: China
transfer safeguard: EU SCCs; outbound payloads contain no special-category data; prompts are not retained by DemoScreen after the response is returned

Privacy notice: /privacy. DPA: /legal/dpa.