We engage the third parties below to process personal data on our behalf. Each is bound by written terms imposing data protection obligations no less protective than those in our Data Processing Addendum, and we remain responsible to you for their performance.
This list was last updated on 2026-07-27. To be notified before a new sub-processor starts processing, email contact@hanuxai.com and ask to be added to the notification list. Your right to object is set out in section 5 of the DPA.
Infrastructure
| Sub-processor | Purpose | Data it receives | Primary location |
|---|---|---|---|
| Supabase | Authentication and primary database | Email, name, password credentials, and all application records including brand, content, billing and prospect data | United States / EU |
| Cloudflare | Website and application hosting, edge functions, R2 object storage, email routing for outreach replies | Generated video and image files, uploaded media, request metadata including IP address, inbound reply emails | Global edge network |
Payments
| Sub-processor | Purpose | Data it receives | Primary location |
|---|---|---|---|
| Stripe | Subscription billing and payment processing | Email, billing details, payment method. Stripe is an independent controller for payment data; we never receive card numbers | United States / Ireland |
Publishing
| Sub-processor | Purpose | Data it receives | Primary location |
|---|---|---|---|
| Zernio | Social publishing broker — holds the platform integrations and posts on your behalf | Social account tokens and identifiers, post content and media, returned performance metrics | United States |
Through Zernio, content and account identifiers reach the platforms you choose to connect — TikTok, Instagram, YouTube, Facebook, LinkedIn, Pinterest, Bluesky, Threads and X. Each platform is an independent controller for what happens on its own service, under its own terms and privacy policy.
AI and content generation
| Sub-processor | Purpose | Data it receives | Primary location |
|---|---|---|---|
| OpenRouter | Routes text generation to large language models | Brand profiles, strategy notes, prompts, scripts, captions and outreach copy | United States |
| Anthropic | Language model provider, used directly as a fallback and for the conversational agents | The same text data as above, plus agent conversation context | United States |
| fal.ai | Image, video, text-to-speech and lip-sync generation | Generation prompts and any source media you supply | United States |
| Replicate | Fallback provider for image, video and speech generation | The same as fal.ai | United States |
| Pexels | Stock video and photography | Search terms derived from your brand profile. No personal data is sent | Germany |
These providers are engaged under terms that do not permit them to train models on the data we send.
Messaging and email
| Sub-processor | Purpose | Data it receives | Primary location |
|---|---|---|---|
| Telegram | Conversational interface for onboarding, approvals and support | Chat identifier, message content, generated media sent for approval | Global |
| Resend | Transactional email, and outreach delivery where you choose it as your provider | Recipient email address, message content, delivery and engagement events | United States |
If you configure your own SMTP server for outreach instead, your messages go through that provider and not through Resend. That provider is your sub-processor, not ours.
Prospect research
| Sub-processor | Purpose | Data it receives | Primary location |
|---|---|---|---|
| SerpAPI | Business directory and search results used to find prospects for the outreach add-on | Search queries built from your target profile — industry, city, region. No customer personal data is sent | United States |
Other third-party requests
Google Fonts serves the typeface used on our marketing pages. Requesting a font discloses your IP address and user agent to Google. It is not a sub-processor in the strict sense — no data is processed on our behalf — but we disclose it because it is the only third-party request our public pages make. See the Cookie Notice.
Services we do not currently use
For the avoidance of doubt, and because you may see references to them elsewhere: we run no advertising networks, no analytics products, no session recording and no data brokers. Funnel measurement is entirely first-party. If that changes, this page changes first.