Legal
Sub-processors
Last updated: May 2026
Crestento relies on the third-party providers below to operate. Each sub-processor is bound by contract to handle Customer data consistent with our Privacy Policy and Data Processing Agreement.
We commit to providing notice before adding new sub-processors that process Customer Personal Data. Subscribe to updates by emailing the support address on your billing receipt.
| Provider | Purpose | Data processed | Region |
|---|---|---|---|
| Anthropic | AI model provider — generates draft text from prompts | Prompt content for the duration of the API call (not retained for training) | United States |
| Supabase | Database, authentication, file storage | All application data (users, organizations, reviews, audit log, attachments) | United States |
| Vercel | Application hosting and edge runtime | Request metadata (IP, user agent), application logs | United States |
| Lemon Squeezy | Merchant of Record — payment processing, subscription management, global tax collection and remittance | Billing details, payment method, invoices, customer name and email | United States |
| Brevo | Transactional email delivery (sign-in links, receipts, alerts) | Email address and message content | European Union |
Cross-border transfers
Where data is transferred between regions (e.g., to US-based sub-processors for EU/UK Customers), we rely on the Standard Contractual Clauses with each sub-processor as the legal mechanism, per Article 46 GDPR / UK Addendum.
Future additions
Likely upcoming sub-processors as the product matures:
- Sentry — error monitoring (request metadata and stack traces, no review content)
- Cloudflare — DNS and CDN (request metadata)
Customers with active paid subscriptions will be notified before these go live.