Sub-processors

Last updated: 6 November 2026

PromptUI is operated by Vrising Properties Ltd (trading as PromptUI), a company registered in England and Wales under company number 15713546, with its registered office at 3 Hemingway Loke, Milton Keynes, Buckinghamshire, MK4 4QG, United Kingdom. This page lists the service providers Vrising Properties Ltd (trading as PromptUI) uses to run the Service and that may process personal data. It forms part of our Data Processing Addendum.

How changes are announced

Before we add or replace a sub-processor that processes your customers' data, we update this page and email the owner of each PromptUI account at least 30 days before the change takes effect. If we have to make a change sooner (for example, to keep the Service secure or running when a provider fails), we tell you as soon as we can. You can object as set out in the Data Processing Addendum.

Where a location says "to confirm", we have not yet checked the region against the provider's account settings or contract, and we will update this page when we have. Where a transfer basis says "to confirm", we have not yet confirmed which UK transfer mechanism the provider's terms include.

Providers that may process your customers' data

Supabase
What it does
Main database (PostgreSQL) for the Service
Data
Account, workspace and project data, including inbox messages, lead-form answers, enquiries and ad-click identifiers
Location
Ireland (EU, eu-west-1)
Transfer basis
UK adequacy regulations for the EEA
Turso
What it does
Managed databases for apps built with PromptUI Cloud data
Data
Records that the app owner and the app’s users store in the app
Location
Per code defaults, the customer-app region the owner chooses: United States by default; EU region = London (UK); Australia = Sydney. The TURSO_LOCATION setting can override this (to confirm)
Transfer basis
UK region: no restricted transfer. US and Australia: The provider's published terms do not state a UK transfer mechanism; we are obtaining it from the provider (to confirm)
Used
When an app uses PromptUI Cloud data
PromptUI Cloud data (Supabase, AWS, Vercel in the chosen region)
What it does
Database, media rendering and hosting for apps built with PromptUI Cloud data
Data
Records that the app owner and the app’s users store in the app
Location
United States, Europe or Australia, as the app owner chooses; United States by default. The Europe option uses London (UK) for Turso databases and Ireland and Frankfurt (EU) for the other services
Transfer basis
Europe option: no restricted transfer for London (UK); UK adequacy regulations for the EEA for Ireland and Frankfurt. US and Australia: the UK Addendum to the EU Standard Contractual Clauses in the Supabase, AWS and Vercel data processing terms
Used
When an app uses PromptUI Cloud data
Vercel
What it does
Hosting and server functions that run the Service
Data
All data the Service handles while it processes a request, and request logs (IP address, user agent)
Location
Growth, customer, Missions and video-render server functions: Dublin, Ireland (EU, dub1). All other server functions: United States (iad1)
Transfer basis
Dublin: UK adequacy regulations for the EEA. United States: the UK Addendum to the EU Standard Contractual Clauses, in Vercel's DPA
Vercel Blob
What it does
File storage for uploads and generated assets
Data
Files you upload and media the Service generates, which can show people
Location
The one region chosen when the store was created (to confirm), with copies cached on Vercel’s global network
Transfer basis
the UK Addendum to the EU Standard Contractual Clauses, in Vercel's DPA
OpenRouter
What it does
Routes AI requests to model providers
Data
Prompts, Brand Kit, drafts and, when you ask for a reply draft, the message, comment or review being answered
Location
United States (Google Cloud US regions)
Transfer basis
the UK Addendum to the EU Standard Contractual Clauses, in OpenRouter's DPA
AI model providers reached through OpenRouter (for example Anthropic, OpenAI, Google, xAI, and hosts outside China for open-weight models such as DeepSeek)
What it does
Write and check text, describe images and transcribe audio
Data
The same content as OpenRouter, for the one request
Location
Varies by provider. Growth, Ads and Operate text and image requests are configured to exclude hosting providers based in China and to ask the provider not to store or train on the data, where the request type supports it. Audio is transcribed by default with a model not hosted in China (to confirm)
Transfer basis
To PromptUI's AI router: the UK Addendum to the EU Standard Contractual Clauses, in OpenRouter's DPA. Onward to each model provider: that provider's own terms (to confirm per provider)
OpenAI (direct)
What it does
Text to speech, audio transcription and image generation
Data
Script text, audio and image prompts
Location
Not stated in the provider’s published terms; we are asking the provider (to confirm)
Transfer basis
OpenAI's data processing addendum (to confirm: we could not read its UK transfer clause from OpenAI's site)
Google Gemini API (direct)
What it does
Back-up AI model for text and images
Data
Prompts and content the task needs
Location
Any country where Google or its sub-processors have facilities
Transfer basis
the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), under which Google states it is certified, with standard contractual clauses as the fallback, in Google's processor terms
Anthropic (direct)
What it does
AI model used inside build environments
Data
Prompts and project files the build needs
Location
Stored in the United States; requests may be processed in the United States, Europe, Asia and Australia
Transfer basis
the UK Addendum to the EU Standard Contractual Clauses, in Anthropic's DPA
Groq
What it does
Back-up AI model host (direct connection, used only if we switch it on)
Data
Prompts and content the task needs
Location
United States, and other countries where Groq or its sub-processors operate
Transfer basis
the UK Addendum to the EU Standard Contractual Clauses, in Groq's DPA
DeepInfra
What it does
AI model host (through OpenRouter, and a direct connection used only if we switch it on)
Data
Prompts and content the task needs
Location
United States
Transfer basis
The provider's published terms do not state a UK transfer mechanism; we are obtaining it from the provider (to confirm)
Google (Veo), reached through OpenRouter
What it does
Generate short video clips
Data
The text prompt and the photos or other pictures chosen for the clip
Location
Any region Google uses (OpenRouter sends these requests with global routing)
Transfer basis
To OpenRouter: the UK Addendum to the EU Standard Contractual Clauses, in OpenRouter's DPA. Onward to Google: the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), under which Google states it is certified
Used
When you create a video
HeyGen, reached through OpenRouter
What it does
Generate short video clips
Data
The text prompt and the photos or other pictures chosen for the clip
Location
Not stated in the provider’s published terms; we are asking the provider (to confirm)
Transfer basis
To OpenRouter: the UK Addendum to the EU Standard Contractual Clauses, in OpenRouter's DPA. Onward to HeyGen: the UK Addendum to the EU Standard Contractual Clauses (the ICO International Data Transfer Addendum) or the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), in HeyGen's DPA
Used
When you create a video
Amazon Web Services (Remotion Lambda)
What it does
Renders videos
Data
Scripts, images and media in the video
Location
United States (us-east-1)
Transfer basis
the UK Addendum to the EU Standard Contractual Clauses, in the UK GDPR Addendum to the AWS DPA
Used
When you create a video
ElevenLabs
What it does
Voiceovers for videos
Data
Script text
Location
United States (ElevenLabs’ standard hosting)
Transfer basis
the UK Addendum to the EU Standard Contractual Clauses, in ElevenLabs' DPA
Used
When a video has a voiceover
Trigger.dev
What it does
Runs background jobs
Data
Job inputs, status and logs, which can include content being processed
Location
United States (AWS us-east-1)
Transfer basis
the UK Addendum to the EU Standard Contractual Clauses, in Trigger.dev's DPA
E2B
What it does
Isolated environments to build, preview and check apps
Data
Generated project files and build or runtime output
Location
Not stated in the provider’s published terms; we are asking the provider (to confirm)
Transfer basis
The provider's published terms do not state a UK transfer mechanism; we are obtaining it from the provider (to confirm)
Upstash
What it does
Short-lived data used to run the Service, such as rate-limit counters
Data
Identifiers and short-lived request data
Location
The primary region chosen when the database was created (to confirm)
Transfer basis
Upstash's DPA (to confirm: we could not read its UK transfer clause)
Resend
What it does
Sends service emails, including enquiry notifications to the account owner
Data
Recipient email address and message content, which can include enquiry details
Location
United States
Transfer basis
the UK Addendum to the EU Standard Contractual Clauses, and the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), in Resend's DPA
Telegram, Slack, Discord and Microsoft Teams
What it does
Deliver alerts to the account owner, on the channels the owner connects
Data
Inbox alerts: the sender’s name and up to 200 characters of their message. Lead-form alerts contain no personal data
Location
Telegram: the Netherlands, for UK and EEA users. Slack: United States, unless the Slack workspace uses data residency. Discord: United States. Microsoft Teams: the region of the Microsoft 365 tenant
Transfer basis
Telegram (Netherlands): UK adequacy regulations for the EEA. Slack, Discord and Microsoft: the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), which each states it complies with
Used
When you turn on alerts for that channel
Sentry
What it does
Error and performance monitoring
Data
Error reports, which can include request details and parts of the content being processed
Location
Germany (EU)
Transfer basis
UK adequacy regulations for the EEA
PostHog
What it does
Product analytics
Data
Product events and account identifiers
Location
United States
Transfer basis
EU Standard Contractual Clauses, as PostHog states; the UK Addendum to them is to confirm
Arcjet
What it does
Protects the Service from bots and abuse
Data
IP address, user agent and request details
Location
Several regions; Arcjet does not guarantee that a request is processed in the region it came from
Transfer basis
UK standard contractual clauses or UK adequacy regulations, as Arcjet’s privacy policy states
Jina AI
What it does
Reads public web pages you ask PromptUI to fetch
Data
The page address and the public page content
Location
Not stated in the provider’s published terms; we are asking the provider (to confirm)
Transfer basis
Elastic's data processing addendum, which Jina AI's terms refer to (to confirm)

Providers that process only account-holder data

These providers handle data about you as a PromptUI account holder, which PromptUI controls. We list them so the picture is complete.

Clerk
What it does
Sign-in and account identity
Data
Account holders’ names, email addresses and sign-in details
Location
Wherever Clerk or its sub-processors have facilities, mainly Google Cloud and Cloudflare data centres
Transfer basis
the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), with the UK Addendum to the EU Standard Contractual Clauses as the fallback, in Clerk's DPA
Stripe
What it does
Payments and billing
Data
Billing details of the account holder (PromptUI never sees full card numbers)
Location
United States (Stripe, LLC), with transfers on a global basis
Transfer basis
The Data Privacy Framework and the UK International Data Transfer Addendum, in Stripe's Data Transfers Addendum
GitHub
What it does
Sign-in and repository import and export
Data
GitHub account details and the repositories you authorise
Location
United States, or any other country where GitHub or its sub-processors operate
Transfer basis
the UK Addendum to the EU Standard Contractual Clauses and the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), in GitHub's data protection agreement
Used
When you connect GitHub
Tolt
What it does
Credits the partner who referred a new subscriber
Data
Referral code and subscription event of the account holder
Location
United States
Transfer basis
Standard contractual clauses with the UK addendum, as Tolt’s privacy policy states (Tolt’s DPA is on request; to confirm)
Used
When you arrive through a referral link and consent where required

Platforms you connect

Meta (Facebook, Instagram, Threads), Google (YouTube, Google Ads, Google Business Profile), LinkedIn, X, TikTok and Shopify are not on this list. You choose to connect them, and they handle the data you publish or read through them under their own terms with you. Stock-media search (Pexels) receives search terms only and is not listed.