Sub-processors
Alpha Exotic Tech LLC engages the third parties below to help deliver SkedCast. Each may process personal data on our behalf under a signed data-processing agreement with appropriate safeguards, including the Standard Contractual Clauses for transfers of EU/UK personal data where relevant.
1. Current sub-processors
The following sub-processors may process personal data to provide the Service:
| Sub-processor | Purpose | Data categories | Region | Transfer |
|---|---|---|---|---|
| Alpha Exotic Tech (Private) Limited | Intra-group engineering and customer-support (staff access under our DPA) | All processed data, on a least-privilege, as-needed basis | Pakistan | SCCs / UK IDTA |
| Contabo GmbH | Application compute and networking for the API and background worker, including the self-hosted job queue and malware scanner running on that infrastructure | All processed data in transit/at rest within the platform | Germany (European Union) | EU/EEA — no transfer required |
| Supabase | Managed PostgreSQL — primary database (accounts, connected-account metadata, audit log) | Account, connected-account metadata, content metadata | European Union | EU/EEA — no transfer required |
| Google Cloud Platform (Cloud Run) | Front-end application hosting (console, admin, and marketing sites) | Request metadata and session cookies | Singapore / global edge | SCCs / DPF |
| Cloudflare, Inc. (R2 object storage & CDN) | Media object storage and delivery | Uploaded media and thumbnails | Per bucket region / global edge | SCCs where applicable |
| Stripe | Billing, subscriptions, and metered usage | Billing contact and payment metadata (no card numbers stored by us) | Global | SCCs / DPF |
| Resend | Transactional and notification email delivery | Recipient email address and message content | United States | SCCs / DPF |
| Google LLC (Google Analytics 4) | Marketing-website analytics — loaded only after a visitor accepts analytics cookies, and never when Global Privacy Control is asserted | IP address, pseudonymous client id, and page-view events on the marketing site | United States | SCCs / DPF |
| Anthropic | AI caption generation, reformatting, and content variation | Prompt content (the post text you submit for assistance) | United States (per API region) | SCCs / DPF |
“SCCs” means the EU Standard Contractual Clauses (with the UK IDTA for UK transfers); “DPF” means reliance on the Data Privacy Framework where the provider is certified. The applicable mechanism is incorporated into our Data Processing Addendum.
2. Services we run ourselves
Some parts of SkedCast that are commonly outsourced are run by us, on the hosting listed above, rather than by a third-party vendor. Our scheduling/job queue, malware scanning, application error monitoring, and performance telemetry are all self-hosted. Because no third party receives that data, those services are not sub-processors and are covered by our hosting provider entry. If we ever move any of them to a vendor-operated service, we will add that vendor to the table above.
3. A note on connected platforms
The social platforms you connect and publish to (Meta, Google/YouTube, X, TikTok, LinkedIn, Pinterest, Bluesky, and Telegram) are not our sub-processors. When you direct SkedCast to publish on your behalf, those platforms process the relevant data as your own processors, or as independent controllers, under their terms. How we use the data we obtain from each is described on our Platform API Data Use & Compliance page.
4. Changes & objections
We keep this list current. Customers with a data-processing agreement will be notified of new sub-processors and may have a right to object as set out in our Data Processing Addendum. Questions about this list can be sent to [email protected].