Why this page exists
You should be able to see exactly who touches your data.
Obrasken is built on third-party infrastructure. Rather than describing them as a vague category, we name each one, what it does, and what it receives. This is the authoritative list referenced by the Privacy Policy.
Each provider acts as a processor on our instructions under a data processing agreement, may only use the data to provide its service, and is bound to confidentiality and security obligations.
Infrastructure
Hosting, database, network. These see the most.
| Provider | Purpose | Data received | Primary region |
|---|---|---|---|
| Supabase | Authentication, database, file storage | Account, content, usage, security, consent records | United States (us-east-2) |
| Vercel | Application hosting, serverless execution, CDN | Request metadata, IP, technical data; content in transit | United States, global edge |
| Cloudflare | DNS, TLS, network protection | IP, request metadata | Global edge |
Payments and communication
| Provider | Purpose | Data received | Primary region |
|---|---|---|---|
| Stripe | Card processing, subscriptions, invoices | Email, billing identifiers, payment method (held by Stripe, not us) | United States, Ireland |
| Resend | Transactional email delivery | Email address, message content | United States |
| Optional sign-in with Google | Google account identifier, email, basic profile | United States, global |
AI generation providers
These receive only the prompt and inputs for the generation you asked for.
| Provider | Purpose | Data received | Primary region |
|---|---|---|---|
| fal.ai | Image and video generation | Prompt and input media for that request | United States |
| OpenAI | Text and multimodal generation | Prompt and input content for that request | United States |
| Replicate | Model hosting for specific generation features | Prompt and input media for that request | United States |
| Runway | Video generation features | Prompt and input media for that request | United States |
| ElevenLabs | Voice and audio features | Text and audio you submit for that request | United States |
A provider is only called when you run a feature that uses it. Features that run locally or on our own infrastructure are labelled in the interface and send nothing to these providers.
If you use Bring Your Own Key, the request runs under your own account with that provider, governed by your agreement with them rather than ours.
International transfers
Most providers above operate primarily in the United States. For transfers originating in the EEA, UK, or Switzerland we rely on Standard Contractual Clauses (with the UK Addendum where applicable). For Canadian personal information we remain accountable under PIPEDA and require comparable protection by contract.
Changes to this list
We update this page when a provider is added or removed. If you would like advance notice of changes for compliance purposes, email privacy@obrasken.com and we will add you to a notification list.
Version history
- Version 2.02026-07-29
- First published. Previously only Supabase and Stripe were named, inside the Privacy Policy.