Sub-processors
The companies that process personal data for SemPost, what each one receives, where it works, and how we announce changes.
Version and validity
- Version: 30 October 2026. This version applies from that date.
- Last updated: 30 October 2026.
- From: CS Digital Wonders (CS Digital Wonders LLC, a limited liability company organized under the laws of the State of Wyoming, USA; 30 N Gould St Ste N, Sheridan, WY 82801, USA). SemPost is a product of CS Digital Wonders.
- How changes are announced: at least 14 days before a new sub-processor starts processing personal data for us, we email the owners and admins of every workspace and add the change, with its date, to this page (see "How we announce changes" below). Other edits are recorded in the Changes section at the end of this page.
What this page lists
This page names the companies that process personal data for SemPost. It is Annex III of our Data Processing Agreement ("DPA").
For each company you see its legal name and country, what it does for us, which personal data it receives, where it processes data, which safeguard its terms provide for a transfer to another country, its role and when it was added. Each company's name links to its own privacy policy. The "Role" column uses these terms:
- Sub-processor: processes personal data in your content on our behalf, while we act as your processor under the DPA.
- Processor for our own data: processes personal data for which SemPost itself is the controller, such as user accounts, sign-in security and the emails we send. Our Privacy Policy explains that processing.
- No personal data: a provider that receives no personal data from us.
Companies that act as independent controllers (Link (Stripe) and Shopify), and services that we do not count as sub-processors, are listed separately below. Anyone may ask us for this list by email at [email protected].
"Added" shows when a company was put on this list. "First version" means it has been on the list since the first published version (30 October 2026).
Sub-processors in use
| Company | What it does for SemPost | Personal data it receives | Location | Transfer safeguard | Role | Added |
|---|---|---|---|---|---|---|
| Contabo: Contabo GmbH, Germany | Our servers: the application, the websites, the database and the cache | All personal data that SemPost holds | USA (Contabo's US region) | Contabo's data processing agreement with the EU standard contractual clauses, which Contabo provides for servers outside the EU | Sub-processor and processor for our own data | First version |
| Cloudflare: Cloudflare, Inc., USA | Network in front of our servers (encryption, attack protection, firewall); Cloudflare Access for our admin console; Turnstile bot check on sign-in forms; R2 storage for media files and database backups; cookie-free statistics for www.sempost.ai and docs.sempost.ai | All traffic to SemPost; for Turnstile, the check token and the visitor's IP address; in R2, your media files and our backups, which are encrypted on our server before upload | Worldwide network. R2 storage: no storage region is set for our buckets, so Cloudflare chooses where files are stored, which can be outside the EU and Turkey | Cloudflare's data processing addendum with the EU standard contractual clauses and the UK Addendum; Cloudflare is certified under the EU-U.S. Data Privacy Framework | Sub-processor and processor for our own data | First version |
| Zernio: ZERNIO SOFTWARE SL, Spain | Social media gateway: connecting your social accounts, publishing, reading analytics, comment-to-DM when you turn it on, Instagram music search | Your workspace's identifier; post texts, media and settings; comment-to-DM message texts; details of connected accounts and the networks' access tokens, which Zernio holds; the record of who received a comment-to-DM message; no user email addresses | United Kingdom: main database in London (Amazon Web Services, through PlanetScale); Western Europe: media files (Cloudflare); some of Zernio's own providers are in the USA | Zernio is established in the EU. Under its data processing agreement, its transfers rely on the UK adequacy decision and, for its US providers, on the EU-U.S. Data Privacy Framework or the EU standard contractual clauses | Sub-processor | First version |
| Anthropic: Anthropic, PBC, USA | Writing post texts and brand suggestions with Claude models, including the AI writer | Product data and photos; brand settings (voice, banned words); your notes and up to 4 images or video frames when you use the AI writer; if you choose it, the texts of up to 5 of your best posts | USA | Anthropic's data processing addendum with the EU standard contractual clauses (Modules 2 and 3) and the UK and Swiss addenda | Sub-processor | First version |
| Google (Gemini API): Google LLC, USA | Editing images and creating scene images; reading voiceover texts aloud (text-to-speech) | Product photos and other images you edit; instructions; voiceover texts | Any country where Google or its agents have facilities | Google's data processing addendum for products where Google is a data processor, with the EU standard contractual clauses; Google LLC is certified under the EU-U.S. Data Privacy Framework | Sub-processor | First version |
| fal.ai: Features & Labels, Inc., USA | Running AI models for video clips, ambient sound and, as a fallback, images (see the notes below) | Images such as product photos, scene images and the first frames of clips, through links valid for 1 hour; for ambient sound, a small silent copy of the finished video without logo; instructions | USA and other countries | fal's data processing addendum, part of its terms of service, with the EU standard contractual clauses and the UK Addendum | Sub-processor | First version |
| Resend: Plus Five Five, Inc., USA | Sending our emails: account emails, invitations and notices to workspace owners and admins | Recipient email address, names, workspace name, links in the email | USA | Resend's data processing addendum with the EU standard contractual clauses and the UK Addendum; Resend complies with the EU-U.S. Data Privacy Framework | Processor for our own data | First version |
| Have I Been Pwned: Superlative Enterprises Pty Ltd, Australia | Checking whether a new password appears in known data breaches | No personal data: only the first 5 characters of the SHA-1 hash of the password, sent from our server; never the password itself, the full hash or your email address (see the note below) | Australia; the service runs on Cloudflare and on Microsoft Azure in the USA | Not needed: no personal data | No personal data | First version |
| Stability AI: Stability AI US Services Corporation, USA | Creating tracks for our own background music library | None: only the music descriptions our staff write | USA | Not needed: no personal data | No personal data | First version |
Notes on each sub-processor
- Contabo: our virtual servers are in Contabo's US region.
- Cloudflare: media files are kept in a private bucket and are only reachable through signed links that expire. Database backups are encrypted with AES-256 on our server before they are uploaded, and are kept for about 4 weeks. Cloudflare Access protects our admin console, so it processes the sign-in data of our own staff. The website statistics on www.sempost.ai and docs.sempost.ai use no cookies .
- Zernio: Zernio holds the access tokens of your social networks; SemPost keeps only a key limited to your workspace's profile, encrypted. The permission screen of each network shows Zernio's app. Link tracking is off in comment-to-DM messages, so people who click the link are not tracked. Zernio describes itself as a processor under Article 28 GDPR, and its terms are governed by Spanish law. Zernio's data processing agreement (zernio.com/dpa, version of 19 October 2026) is part of its terms (zernio.com/tos, version of 9 October 2026), which apply when the service is used, so no separate signature is needed. That agreement is written for customers who are controllers; it has no separate terms for the case where SemPost processes your data as your processor. We hold Zernio to its agreement and remain responsible to you for its work, as section 8.2 of the DPA says. Zernio announces new sub-processors of its own 14 days in advance, must tell us about a personal data breach within 72 hours, and when our service ends deletes the data within 10 business days (from backups within 30 days, from logs within 90 days). How long Zernio keeps the record of who received a comment-to-DM message while the service runs is set by Zernio; see its privacy policy. If a person asks for their record to be deleted, we pass the request on to Zernio.
- Anthropic: images are reduced to 768 pixels before they are sent. Examples from your best posts are only used if you switch on that option in the AI writer; each example is at most 600 characters.
- Google: we use the paid tier of the Gemini API. Under its terms, Google does not use this data to improve its products; it keeps logs of requests for a limited time, only to detect misuse and to meet legal requirements. Our requests ask Google not to store them.
- fal.ai: motion clips use Wan 2.2 by default, an open-weight model that fal runs on its own infrastructure. You can choose other models in Settings › AI models: Kling and Gemini Omni Flash (a Google model whose clips carry Google's SynthID watermark). Seedance (ByteDance) is hidden and is only offered if our admins turn it on. Ambient sound uses Mirelo SFX 2.0 (a model of Mirelo AI GmbH). If the Gemini API is unavailable or cannot complete a request, image editing falls back to Google's Nano Banana 2.1 model as offered on fal, at 1K resolution. Depending on the model, fal may pass a request on to the company that made the model. Outputs are delivered through fal's content network, from where we download them. fal keeps inputs and outputs under its own terms.
- Resend: our emails load no remote images; the logo is embedded in the email. They carry no tracking pixel and no tracked links: open and click tracking is off.
- Have I Been Pwned: the check is part of our password rules when a password is chosen. Only the 5 characters described above leave our server. They match a very large number of different passwords and are sent from our server with nothing that identifies you, so we do not treat them as personal data.
- Stability AI: used only by our staff to build the music library; your content is never sent to it.
- Model training: under Anthropic's commercial terms and Google's terms for the paid Gemini API, they may not use the data we send to train their models. fal processes the data under its terms for business customers (terms of service, data processing addendum). Stability AI receives none of your data.
Independent controllers
These companies receive personal data in connection with SemPost but decide themselves how they process it, under their own terms. They are not our sub-processors.
| Company | What it does | Personal data involved | Location | Their terms |
|---|---|---|---|---|
| Link (Stripe): Link, LLC, USA | Sells SemPost on the web as merchant of record: checkout page, subscriptions, receipts and invoices, tax, refunds, payment support and disputes; the customer portal | We send the workspace name as customer name, the purchaser's email address and the workspace identifier. Link collects card details, billing address and tax ID itself. Reasons for cancelling stay with Stripe | USA and the other countries where Stripe works | Link's privacy policy (Stripe) and Link's terms |
| Shopify: Shopify Inc., Canada, with which we have Shopify's partner agreement; your own contract with Shopify may be with another Shopify company, depending on where you are | For stores that install SemPost from the Shopify App Store: installation, sign-in with Shopify, billing through Shopify and access to the store's products | Shopify sends us the store's domain and identifier and the signed-in staff member's name and email address; we send Shopify usage charges, which contain no personal data. In the Shopify app, Shopify's App Bridge script is loaded from Shopify's servers | Canada and the other countries where Shopify works | Shopify Privacy Policy |
If you ask Link to delete your data, Stripe cancels your SemPost subscription, deletes the personal data in its records and informs us by email. Your workspace then has no open plan, but its data is not deleted by this. See Data deletion.
Services that are not sub-processors
- The social networks you publish to: Instagram, Facebook and Threads (Meta), TikTok, Pinterest, LinkedIn, YouTube and Google Business Profile (Google), and Bluesky. You choose to publish there; they receive your content through Zernio and process it under their own terms.
- Stores and websites we read products from: your store, or any product page address you enter. These sites see our server's address and our user agent "SemPostBot/1.0". We send them no personal data.
- GitHub: hosts our source code and runs our build pipeline. It receives no customer personal data.
- Our own music server: a separate server of ours renders background music from note data (MIDI) in signed requests. It receives no personal data. It runs on a Contabo server in Germany.
In our code but not used today
Our code can work with these services, but they receive no data today. If we turn one on, we announce it at least 14 days in advance like any new sub-processor.
- ElevenLabs: text-to-speech for voiceovers. Switched off until business terms are signed. If used, it would receive voiceover texts.
- Upload-Post: a backup social media gateway. There is no account. If used, it would receive posts and a profile for your workspace.
- Brevo: an email service that our code supports as an alternative to Resend. Not used: SemPost's emails go through Resend (since 13 October 2026), and SemPost's domain has not been set up as a sender at Brevo, so Brevo receives no SemPost data.
Transfers to other countries
Our servers are in the USA, and most sub-processors are outside the EU and Turkey. Section 9 of the DPA describes the safeguards: the EU standard contractual clauses (with the UK Addendum for the UK), and for transfers from Turkey the KVKK Standard Contracts, which must be signed. The "Transfer safeguard" column above shows, for each company, the safeguard that its terms provide.
Sub-processors of our sub-processors
Our sub-processors use their own service providers. Where they publish their lists, we link to them here, and on request we tell you what the others have disclosed to us:
- Cloudflare: cloudflare.com/gdpr/subprocessors
- Zernio: zernio.com/subprocessors
- Anthropic: anthropic.com/subprocessors
- Resend: resend.com/legal/subprocessors
How we choose sub-processors
Before a company processes personal data for us, we check its security and data protection terms and put in place a contract, usually the company's own data processing agreement, that gives it data protection obligations equivalent to those in our DPA. AI providers process your data only to produce the result you asked for, under the training terms described in the notes above. Provider keys are stored encrypted in our database. When an AI provider fetches a file from our storage, it gets a link that expires after 1 hour; other pictures are sent inside the request.
How we announce changes
- New sub-processor, or a new purpose or new country for an existing one: at least 14 days before the change, we email the owners and admins of every workspace and add the company to this page with the planned start date.
- Urgent replacement: if a sub-processor stops its service or has a security problem, we may have to replace it with shorter notice. We then tell you as soon as possible.
- Removal: when we stop using a company, we remove it from this page.
Every change is recorded with its date in the Changes section below.
How to object
If you use SemPost as a controller, you may object to a new sub-processor within 14 days after our notice, on reasonable data protection grounds. Write to [email protected] and say which change you object to and why.
We will try to find a solution with you, for example by keeping the feature or AI model that uses the company switched off for your workspace. If we cannot find one within 30 days, you may end the affected part of the service, or the whole agreement if SemPost cannot be used without the new sub-processor. We then refund, pro rata, the fees you paid in advance for the period you can no longer use, through the channel you paid with (Link or Shopify). Section 8 of the DPA sets out the details.
Contact
Questions about this list: [email protected]. Security reports: [email protected]; see also Security.
Changes
| Date | Change |
|---|---|
| 30 October 2026 | First published |