Sub-processors
The third parties that process personal data on our behalf, and where.
KEY DETAILS — the only place these values appear. To update the company, country, product, contact or date, change them here and nowhere else in this document.
Field Value Company ZARZOOM Ltd (referred to in this document as "the Company", "we", "us" or "our") Company registration 17428670 Registered address 13 Bournehall Lane, Bushey, WD23 3NQ, United Kingdom Product / Service name ZARZOOM (the "Service") Website https://zarzoom.com Privacy / data contact privacy@zarzoom.com Last updated 2026-09-02
1. About this list
1.1 This is the list of third parties ("sub-processors") that process personal data on our behalf when we provide the Service. It is the list referred to in section 4 of our Data Processing Agreement and section 6 of our Privacy Policy.
1.2 Each sub-processor is bound by a contract that requires it to protect personal data and to use it only to provide its service to us. Where a sub-processor is outside the UK or EEA, a lawful transfer mechanism applies as described in section 8 of the Privacy Policy.
1.3 Locations marked CONFIRM are the provider's principal processing location as we currently understand it and are being verified against each provider's own data-processing terms. We will update this page as each is confirmed.
2. Where our own infrastructure runs
| Component | Provider | Location |
|---|---|---|
| Primary database and authentication | Supabase | United States (AWS, us-east-1) |
| Web application and server-side compute | Vercel | United States (iad1) |
| Media storage (images, audio, video, uploaded files) | Cloudflare R2 | Western Europe |
| Content-generation engine | Hostinger (virtual private server) | United Kingdom (Manchester) |
3. Sub-processors
| Provider | What it does for us | Personal data it may receive | Location |
|---|---|---|---|
| Supabase | Database, authentication, file storage | All account, workspace, content and audit data | United States |
| Vercel | Hosting and compute for the website and API | All data passing through the web application | United States |
| Cloudflare | Object storage (R2) for media; network security | Uploaded and generated media, including face images and voice recordings | Western Europe (R2); global network |
| Stripe | Payments and subscription billing | Billing name, email, address, country, payment identifiers (card numbers are held by Stripe, not by us) | United States and Ireland — CONFIRM |
| Upload-Post | Routing Content to your Connected Accounts | Content to be published; social-account access tokens and identifiers | CONFIRM |
| OpenRouter | Routing requests to AI text models | Prompts, brand profile text and Content being generated | United States — CONFIRM |
| OpenAI | Content moderation and speech-to-text | Content being screened; audio being transcribed | United States |
| fal.ai | Image and video generation, including presenter (avatar) video | Image prompts; face images you provide for an Avatar | United States — CONFIRM |
| ElevenLabs | Text-to-speech and voice cloning | Scripts; voice recordings you provide for a cloned voice | United States — CONFIRM |
| Inworld | Text-to-speech and voice cloning | Scripts; voice recordings you provide for a cloned voice | United States — CONFIRM |
| Exa | Web search used during research and fact-checking | Search queries derived from your brand and topics (no account data) | United States — CONFIRM |
| Pexels | Stock imagery and B-roll video | Search terms derived from your Content (no account data) | CONFIRM |
| Hostinger | Hosting for the content-generation engine; transactional email delivery | Content in generation; email addresses and message contents for emails we send you | United Kingdom (engine); email — CONFIRM |
| Telegram | Internal operator alerts | Operational alerts, which may include a workspace or account identifier | CONFIRM |
| Sign-in with Google; Google Business Profile publishing; website analytics (Google Analytics, only if you accept optional cookies) | Sign-in identity; Business Profile content and tokens; analytics identifiers and usage data | United States and EU — CONFIRM |
4. Changes to this list
4.1 We will update this page before we engage a new sub-processor or replace an existing one. Business Customers may object on reasonable data-protection grounds as set out in section 4.3 of the Data Processing Agreement. The "Last updated" date in the Key Details shows the current version.
5. Language
5.1 The authoritative version of this list is the English version. Translations, where provided, are for convenience only.
5.2 In the event of any conflict, inconsistency, ambiguity, or question of interpretation between the English version and any translation, the English version prevails.
End of Sub-processors.