Legal
Sub-processors
The third-party services SaliencyLab engages to operate the product, what they do, where they run, and the data they receive.
Last updated: April 20, 2026
| Service | Purpose | Region | Data types |
|---|---|---|---|
| Supabase | Primary database, authentication, edge functions, and object storage for uploaded creatives. | EU (Frankfurt) | Account data, authentication tokens, Customer Content (images, videos), analysis results. |
| Vercel | Web hosting and serverless edge runtime for the Next.js application. | United States (global edge network) | Request metadata, IP addresses, HTTP logs. No raw Customer Content stored at rest. |
| Google Cloud — Vertex AI (Gemini) | Multimodal AI scoring and report generation from uploaded creatives. | EU (europe-west) where available, otherwise US multi-region. | Customer Content submitted for analysis, structured prompts. Not used for model training per Vertex AI terms. |
| Google Cloud — Video Intelligence & Speech-to-Text | Shot detection, label detection, and audio transcription for video analysis. | EU / US (depending on endpoint). | Video frames and extracted audio. |
| Stripe | Payment processing and subscription management. | United States + EU (Ireland) | Billing contact, payment method tokens. Full card data held by Stripe, never by SaliencyLab. |
| Resend | Transactional email delivery (account, security, receipts). | United States | Recipient email address, message content, delivery metadata. |
| Sentry | Error tracking and performance monitoring. | United States / EU (Frankfurt) — EU region selected where configured. | Error events, stack traces, limited request metadata, optional user id. |
| PostHog | Product analytics, feature flag evaluation, and session-level usage metrics. | EU Cloud (Frankfurt) where configured. | Pseudonymous user id, event name, page path, feature flag state. |
Notice of changes
We will update this page before adding or replacing a sub-processor. Enterprise customers with a countersigned DPA can opt in to receive email notifications of changes at least 30 days in advance. To subscribe, email contact@saliencylab.com with the subject line "Sub-processor notifications".
For international transfers, we rely on the European Commission Standard Contractual Clauses (2021/914) and the UK International Data Transfer Addendum where applicable. See our Data Processing Addendum for full detail.