Service Providers and Subprocessors

This register describes providers by function. The applicable data processing agreement identifies the authorized subprocessor chain for your contracted processing. A provider can have different roles for different activities; payment services, chosen MCP clients and public stock hosts are not automatically subprocessors for every use. Our Privacy Policy explains purposes, data categories, retention and international transfers.

Infrastructure and account services

• netcup: hosting for application services, databases and render workers; project/account data and operational diagnostics. Data protection.
• Backblaze B2: object storage for uploaded media and outputs. The configured media-storage region is eu-central-003. This identifies the bucket region, not a guarantee about every administrative or support access. Privacy.
• Supabase: identity/authentication services, account identifiers, profile and authentication records. Privacy.
• Brevo / configured SMTP delivery: delivery of authentication and operational messages, recipient addresses, message content and delivery status. Brevo privacy.
• Cloudflare: security and network delivery for applicable domains; request/network metadata and delivered content as required by the enabled service. Privacy.
• Intuition Machines / hCaptcha: bot and abuse protection for authentication, including relevant device and interaction data. Privacy.

Optional AI and model infrastructure

• OpenRouter: routing requested AI operations to model providers; necessary prompts, context/media and usage metadata. Downstream routing depends on the selected model and availability. Privacy and terms.
• fal.ai / Features & Labels: requested generative media and background-removal operations, including necessary inputs and outputs. Model-specific infrastructure and conditions apply. Privacy and terms.

Standard editing and ordinary rendering do not require these AI services. Model and provider identifiers are recorded for AI operations. The catalog can include speech/transcription, image/video models and CassetteAI, MiniMax Music, ElevenLabs sound effects or BiRefNet through the configured provider. A model brand is not itself proof of a direct contract between JsonCut and that brand. Do not assume all routes use the same retention, training settings or processing country.

Other recipients chosen through product features

Stripe handles billing and payment operations and may act as an independent controller for relevant payment/regulatory purposes (privacy). Google processes the Google login you select (privacy).

Pexels, Openverse, Wikimedia Commons and source hosts receive stock queries and resource requests required for search, previews and import. jsDelivr delivers versioned font files requested by the browser. Their involvement depends on the resources you use. See media sources and licenses.

OpenAI / ChatGPT, Anthropic / Claude and other MCP clients receive the tool responses you authorize and process them under their own arrangements. Connecting a client is separate from authorizing a JsonCut subprocessor for all customer data.

Contractual instructions, regions and changes

For processing on your behalf, the order and data processing agreement determine the authorized providers, processing locations and transfer safeguards. Contact support@jsoncut.com for your contractual annex, provider changes or safeguard information. A provider's headquarters, an EU bucket location and the actual processing locations are different facts. No EU-only processing commitment arises merely from this register.

Changes to authorized subprocessors follow the information and objection process in the applicable agreement. We do not replace an agreed restricted processing arrangement solely by editing this page.