เอกสารนี้มีให้บริการเป็นภาษาอังกฤษเท่านั้นในขณะนี้
Sub-processors
The third parties that process personal data on our behalf, and where.
KEY DETAILS — the only place these values appear. To update the company, country, product, contact or date, change them here and nowhere else in this document.
Field Value Company ZARZOOM Ltd (referred to in this document as "the Company", "we", "us" or "our") Company registration 17428670 Registered address 13 Bournehall Lane, Bushey, WD23 3NQ, United Kingdom Product / Service name ZARZOOM (the "Service") Website https://zarzoom.com Privacy / data contact privacy@zarzoom.com Last updated 2026-09-07
1. About this list
1.1 This is the list of third parties ("sub-processors") that process personal data on our behalf when we provide the Service. It is the list referred to in section 4 of our Data Processing Agreement and section 6 of our Privacy Policy.
1.2 Each sub-processor is bound by a contract that requires it to protect personal data and to use it only to provide its service to us. Where a sub-processor is outside the UK or EEA, a lawful transfer mechanism applies as described in section 8 of the Privacy Policy.
1.3 The Location column is the provider's principal processing location. The Data-processing terms column states the agreement we rely on with that provider.
2. Where our own infrastructure runs
| Component | Provider | Location |
|---|---|---|
| Primary database and authentication | Supabase | United States (AWS, us-east-1) |
| Web application and server-side compute | Vercel | United States (iad1) |
| Media storage (images, audio, video, uploaded files) | Cloudflare R2 | Western Europe |
| Content-generation engine | Hostinger (virtual private server) | United Kingdom (Manchester) |
3. Sub-processors
| Provider | What it does for us | Personal data it may receive | Location | Data-processing terms |
|---|---|---|---|---|
| Supabase | Database, authentication, file storage | All account, workspace, content and audit data | United States | Standard published DPA |
| Vercel | Hosting and compute for the website and API | All data passing through the web application | United States | Standard published DPA |
| Cloudflare | Object storage (R2) for media; DNS; email routing; network security | Uploaded and generated media, including face images and voice recordings | Western Europe (R2); global network | Standard published DPA |
| Stripe | Payments and subscription billing | Billing name, email, address, country, payment identifiers (card numbers are held by Stripe, not by us) | United States / EU | Standard published DPA |
| Upload-Post (TONVI TECH S.L.) | Routing Content to your Connected Accounts | Content to be published; social-account access tokens and identifiers | Spain (EU) | Standard published terms |
| OpenRouter | Routing requests to AI text models | Prompts, brand profile text and Content being generated | United States | DPA accepted online with the account |
| OpenAI | Content moderation and speech-to-text | Content being screened; audio being transcribed | United States | Standard published DPA |
| fal.ai | Image and video generation, including presenter (avatar) video | Image prompts; face images you provide for an Avatar | United States | DPA incorporated into their standard terms |
| ElevenLabs | Text-to-speech and voice cloning | Scripts; voice recordings you provide for a cloned voice | United States | Published DPA (applies to paid plans; includes a UK addendum) |
| Inworld AI | Text-to-speech and voice cloning | Scripts; voice recordings you provide for a cloned voice | United States | Standard published terms |
| Exa | Web search used during research and fact-checking | Search queries derived from your brand and topics (no account data) | United States | Standard published DPA |
| Jina AI (Jina AI GmbH) | Reading the public pages of a website you give us during setup, when that website refuses our own request | The website address you enter, and the public text of the pages at it, which may include names and contact details published on them | Germany (EU) company; processing in the United States | Standard published terms |
| Pexels | Stock imagery and B-roll video | Search terms derived from your Content (no account data) | United States | Standard published DPA |
| Hostinger | Hosting for the content-generation engine (VPS); transactional email delivery (SMTP) | Content in generation; email addresses and message contents for emails we send you | United Kingdom (Manchester) | Standard published DPA |
| Telegram | Internal operator alerts | Operational alerts, which may include a workspace or account identifier | United Arab Emirates | Standard published terms |
| Sign-in with Google; Google Business Profile publishing; website analytics (Google Analytics, only if you accept optional cookies) | Sign-in identity; Business Profile content and tokens; analytics identifiers and usage data | United States | Standard published DPA |
4. Changes to this list
4.1 We will update this page before we engage a new sub-processor or replace an existing one. Business Customers may object on reasonable data-protection grounds as set out in section 4.3 of the Data Processing Agreement. The "Last updated" date in the Key Details shows the current version.
5. Language
5.1 The authoritative version of this list is the English version. Translations, where provided, are for convenience only.
5.2 In the event of any conflict, inconsistency, ambiguity, or question of interpretation between the English version and any translation, the English version prevails.
End of Sub-processors.