Everpop uses the following service providers and subprocessors to operate the Service. Optional providers receive data only when their integration is configured or you use the relevant feature. Where data-protection law requires it, the applicable contractual and international-transfer safeguards govern the processing. This page mirrors Section 8 of our Privacy Policy.
Current subprocessors
- Vercel Inc. (USA) — application hosting, AI model gateway, and cookieless Web Analytics when enabled for the production project (pageview and request metadata)
- Product analytics and error monitoring — none currently. Browser funnel events you enable are received by Everpop's own endpoint and are not forwarded to any analytics vendor; application errors are written to our own logs. If we add a vendor for either purpose we will list it here first.
- Neon, Inc. (USA) — database hosting, including encrypted point-in-time backups
- Upstash, Inc. (USA) — rate limiting and QStash job-queue infrastructure; depending on the operation, may process IP addresses, email addresses, internal user/source/clip/post/destination/Drive-file identifiers, and queued publishing metadata such as reviewed title, description, and visibility
- Cloudflare, Inc. (USA/EU) — CDN and R2 object storage for source videos, generated media, fonts, and related request metadata; Zero Trust Tunnel proxying of render-engine requests, which may carry source-media URLs, prompts, render settings, internal job identifiers, callback URLs, and ordinary request metadata; and, when Turnstile is configured, anti-bot verification using a challenge token plus IP and browser/device request data
- Hetzner Online GmbH (Germany, EU) — infrastructure hosting for an Everpop render-engine node and fallback capacity. When a render is routed to that node, it may process source video and extracted audio, transcripts, creator prompts, clip timing/title directives, caption and brand settings, referenced hook audio or custom fonts, generated clips and thumbnails, plan tier, and internal job identifiers
- Everpop-operated render machines (Bulgaria, EU) — most renders run on machines we operate ourselves rather than on a cloud host; they process the same render inputs as the Hetzner node above and are not a third party
- Configured external uptime/cron monitoring service — optional dead-man's-switch monitoring used only when an external heartbeat endpoint is configured; receives the cron identifier in the ping URL, ping time, and ordinary connection/request metadata such as the service IP. The application does not include Everpop account identifiers, creator media, transcripts, or prompts in this heartbeat ping
- Stripe, Inc. (USA / Ireland) — payment processing; card data is sent directly to Stripe, while Everpop stores customer/subscription identifiers and subscription, billing-period, payment-state, dispute, and transactional metadata
- AI service providers — currently Anthropic, PBC; Groq, Inc.; OpenAI, Inc.; AssemblyAI, Inc.; xAI; Google LLC; Fireworks AI, Inc.; and Together Computer, Inc. (primarily USA) — audio transcription, moment selection, script and metadata writing, text-to-speech, content-safety screening, and visual analysis. Depending on the feature and configured route, the inputs can include prompts, source audio, video transcripts, titles/descriptions, clip opening hooks, thumbnail images, and candidate clip video. Provider routing varies by feature; we send the inputs needed for that requested operation.
- Pexels (USA) — stock b-roll search; receives visual search keywords derived from generated scripts or words in source speech/transcripts. Queries can therefore contain contextual words or names, but this integration does not send your Everpop account identifier or source-media file
- Resend, Inc. (USA) — transactional and opted-in engagement email delivery; receives recipient email address and message content
- ImprovMX (email forwarding) and Google LLC (mailbox hosting) — receive the messages, sender addresses, and attachments you send to our support@, privacy@, security@, and copyright@ mailboxes, and our replies
- Crisp IM SAS (France, EU) — support chat messages and browser/session metadata; its widget loads only when you separately enable support chat
- Discord Inc. (USA) — optional operational alerts; when a webhook is configured, may receive service-failure details, internal user/subscription/platform/post identifiers, creator-provided video or clip titles, and moderation reasoning. Control characters and message markup are sanitized before sending; these alerts are limited to operational response
- Outstand — retired historical publishing integration. New connections and publishing are disabled. A temporary legacy-drain configuration may receive signed status callbacks and query historical provider post identifiers only until old records are settled.
Changes & notice
We update this list when service-provider use changes. Any advance-notice and objection rights in a signed DPA continue to govern; otherwise, we provide notice of material changes as required by applicable law. Business customers and compliance teams can request current provider, transfer-mechanism, and retention details at privacy@everpop.app.
Data Processing Agreement
See our DPA summary for how we process customer data, or request the full Data Processing Agreement at the address above.