Sub-processors

Version 2026.09.22

Liflio uses the providers below to deliver the service. Each one processes data only on our instructions, under Article 28 GDPR. This page is versioned: every change is recorded in the changelog at the bottom.

AI and machine-learning providers

These receive the briefs, catalogue data, images, video and audio that generation runs on.

Provider	Purpose	What they receive	Processing region	Their retention
OpenAI, L.L.C. Provider documentation	Marketing copy, product-description and caption generation; image editing for product scenes; speech-to-text for video captions.	Campaign briefs, product catalogue rows and prices, text read from your website, product and scene images, and the speech track of any video we caption — including footage you upload yourself. Can contain personal data	United States	Up to 30 days for abuse monitoring. Not used to train OpenAI models.
Anthropic PBC Provider documentation	Marketing copy and creative direction; reading text off uploaded flyers and product labels; quality checks on generated creatives.	Campaign briefs, product catalogue rows, uploaded flyers and marketing material, and brand images from your own website. Can contain personal data	United States	Inputs and outputs deleted after 30 days; content flagged by trust-and-safety systems is kept longer. Not used for training.
Google LLC (Gemini API) Provider documentation	Text generation as an alternative to Claude, and multi-image composition for flyer and product visuals.	Campaign text briefs, product photos and brand assets. Can contain personal data	Not published for the Gemini Developer API. Google documents where the API is available, not where requests are processed. Not verified	Paid tier: logged for "a limited period of time" for policy enforcement — no figure is published; not used to improve Google products. Not verified
Google Cloud (Vertex AI)Not in use Provider documentation	Generation of synthetic people for hero imagery. Switched off: the feature needs an environment flag and enterprise credentials that are not set.	A text prompt only. No customer imagery is sent on this path. No personal data	Chosen by us per request; Vertex offers EU regions.	Governed by the Google Cloud terms for the project. Not exercised today. Not verified
Features and Labels, Inc. ("fal.ai") Provider documentation	Hosts the image and video models we generate with — Kling (Kuaishou), Veo (Google), Seedance (ByteDance), Imagen, FLUX, Recraft, Bria, Nano Banana.	Product photos, brand assets, and the text prompt for an image or a video generated from them. Video you supply is not sent to fal today. Can contain personal data	fal states only "the United States and other countries" and publishes no region per model. Transfers run on the EU Standard Contractual Clauses and the UK IDTA. Not verified	Request data for 30 days. Media files sit on fal’s CDN for a period they do not publish. Not verified
Replicate, Inc. Provider documentation	Hosts the Seedance video models (ByteDance) used by the premium video tiers of the giveaway lane. The main video lane reaches Seedance through fal.ai instead, so the same model family is served by two providers.	A text prompt and, when you pick one, a product photo. Can contain personal data	United States	Inputs, outputs and files from API predictions are deleted automatically after one hour.
SerpApi, LLC Provider documentation	Image search, to collect visual references for a creative brief.	A short search phrase derived from the brief. No customer content and no images are sent. No personal data	Not verified. Not verified	Not verified. Not verified

Infrastructure, delivery and business providers

Provider	Purpose	What they receive	Processing region	Their retention
OVH SAS Provider documentation	Hosts the application and the database.	Everything in your account: profile, catalogue, campaigns, generated content. Can contain personal data	France	For the life of your account. Infrastructure logs are kept 30 days by OVHcloud. Not verified
Cloudflare, Inc. Provider documentation	CDN and DDoS protection in front of the site, and R2 object storage for the video you upload, the images and video we generate, and the intermediate artifacts of the video pipeline.	Requests to the site; stored media, generated creatives, transcripts and subject masks. Can contain personal data	Global edge network; the storage bucket region is set on our account. Not verified	Stored objects are kept until deletion is requested — see the note below the table.
BunnyWay d.o.o. Provider documentation	Media CDN.	Published images and video. No personal data	European Union (Slovenia)	Cached for as long as the asset is published. Not verified
Resend, Inc. Provider documentation	Sends transactional email — sign-up, password reset, billing and product notices.	Your email address and the message body, which may contain AI-generated copy. Can contain personal data	United States (EU–US Data Privacy Framework; SCCs)	Deleted within 90 days of account termination.
Brevo (Sendinblue SAS) Provider documentation	Sends the email campaigns you create to the contact lists you upload.	Recipient addresses and names from your lists, and the campaign body — which is typically AI-generated marketing copy. Can contain personal data	Not verified. Not verified	Not verified. Not verified
Stripe Payments Europe, Ltd. Provider documentation	Subscription billing and payments.	Your name, email and billing details. Card numbers go to Stripe directly and never reach our servers. Can contain personal data	European Union and United States Not verified	As required by law for financial records. Not verified
PostHog, Inc. Provider documentation	Product analytics.	Which features you use, and a pseudonymous identifier. Can contain personal data	European Union (eu.i.posthog.com)	Per PostHog’s retention settings on our account. Not verified
Functional Software, Inc. ("Sentry") Provider documentation	Error monitoring.	Stack traces, the URL that failed, and a user identifier when you are signed in. Can contain personal data	Set by the DSN region on our account. Not verified	Per Sentry’s default event retention (90 days). Not verified
ReqMe Provider documentation	Live chat on the public site. Loaded only after you accept the "Chat" cookie category.	Whatever you type into the chat, plus session information. Can contain personal data	Not verified. Not verified	Not verified. Not verified

“Not verified” means we could not confirm this from the provider’s own published documentation. It is marked rather than guessed.

Notes you should read with the table

Retention above is the provider’s retention of what we send them. Our own retention of your content is in the privacy policy.
Files we store for you — uploaded media, generated creatives, video transcripts and the subject masks used to place captions — are kept until you ask us to delete them. Write to privacy@liflio.com and we will remove them.
Video you upload is processed on our own servers: it is trimmed, reframed and branded there, and no AI model outside Liflio receives any frame of it. The upload and the finished video are stored with our storage provider, Cloudflare (R2). When you ask for captions and keep your clip’s own sound, the audio track alone is sent to OpenAI to be transcribed — the only part of your footage an AI provider receives.
Social platforms you publish to (Facebook, Instagram, LinkedIn, TikTok, Pinterest, X, Telegram, WhatsApp) are not sub-processors. They receive content on your instruction and act for their own purposes. The privacy policy covers them separately.

Objecting to a sub-processor

If you object to a provider on this list, write to privacy@liflio.com. We will tell you what the service cannot do without them and what alternatives, if any, exist.

Changelog

Adding a provider, or widening what an existing provider receives, is recorded here with a new version.

2026.09.22 — 2026-09-22
First published list. Adds the providers the privacy policy had never named: Google (Gemini), fal.ai — which hosts the Kling, Veo and Seedance video models and most of our image models — Replicate, SerpApi and Brevo. No new provider was introduced and no processing changed; this records providers already in use.

16 providers listed.