Sub-processors
The third-party services DeliverCC uses to deliver the platform. All are US-located. We notify Customers with an executed Data Processing Agreement at least 30 days before any change.
Last Updated2026-06-07
Contactdpa@delivercc.io
DeliverCC engages the following Sub-processors to provide the Services. All Sub-processors are US-located; there is no per-customer geographic residency option.
Note on Mac Studio. The Mac Studio used for audio alignment processing is owner-operated by DeliverCC in the United States, under DeliverCC's physical control, and is intentionally not a Sub-processor — it is in-house infrastructure, not a third-party service. Listed here for transparency only.
Supabase, Inc.
- Service
- User authentication, account database, audio file storage
- Location
- United States (AWS us-east-1, Northern Virginia)
- Certifications
- SOC 2 Type II
- Data accessed
- Customer Personal Data (account information), Customer Confidential Audio (audio retained for approximately 14 days from upload, then automatically deleted as described in Section 5.2(c))
Vercel, Inc.
- Service
- Application hosting and serverless function execution
- Location
- United States (iad1 region, Northern Virginia)
- Certifications
- SOC 2 Type II
- Data accessed
- Customer Personal Data in transit during request processing; Customer Confidential Audio is not routed through Vercel for alignment (audio is fetched directly from Supabase Storage by DeliverCC's owner-operated Mac Studio using a service-role credential)
Stripe, Inc.
- Service
- Payment processing and subscription management
- Location
- United States
- Certifications
- PCI DSS Level 1
- Data accessed
- Payment information (handled directly by Stripe), customer billing identifiers (DeliverCC retains only Stripe customer ID and subscription status)
Resend, Inc.
- Service
- Transactional email delivery (receipts, account confirmations, password resets, data-export-ready notifications)
- Location
- United States
- Certifications
- SOC 2 Type II
- Data accessed
- Transactional email metadata only — recipient address, subject, send status. Resend does not access audio, lyrics, or caption content.
Google LLC
- Service
- Optional Google OAuth sign-in
- Location
- United States
- Data accessed
- Where Customer's authorized user chooses to sign in with Google, Google authenticates the user and returns name and email to DeliverCC at sign-in only. Google does not receive audio, lyrics, captions, or any service usage data. Google's own privacy practices govern its handling of the user's Google account.
30-day advance-notice commitment
DeliverCC will notify Customer at least 30 days in advance of adding or replacing a Sub-processor that processes Customer Personal Data. Notification may be made by email to the address Customer provides for this purpose, by updates to this page, or through similar means. See DPA Section 7.3for the full obligation and Customer's right to object.
For the full Sub-processor obligations, see the Data Processing Agreement.
delivercc.io