Subprocessors
Last updated September 24, 2026
These are the companies that receive information from Chartapir in order for the product to work. We list all of them, including our own hosting and email providers, because a list that names only the interesting ones is not a list. Each entry says what that company does and what reaches it.
This page is also a commitment: a new subprocessor appears here before it receives any customer information, and every change is dated in the changelog at the bottom. See our Privacy Policy for how we use information and Terms of Use for the agreement itself.
Processors of your content
These receive your uploaded spreadsheet or table image, data derived from it, or the video made from it.
Supabase
United States
What it does. Authentication, database, account records, and file storage.
What reaches it. Your account identifier and email address, uploaded files, project and job records, and credit balances.
Amazon Web Services
United States — us-east-1
What it does. Processing, rendering, private storage, and delivery of generated files through CloudFront.
What reaches it. Uploaded files, extracted table data, scripts, narration audio, subtitles, and finished videos.
Google — Gemini API
United States
What it does. Writes and structures the video from your data.
What reaches it. A bounded, derived projection of a spreadsheet: column labels, statistics, and a limited sample of values, with columns detected as personal or sensitive withheld from that sample. If you upload an image of a table, the whole image is sent so the table can be extracted.
Microsoft Azure
United States
What it does. Turns narration text into speech.
What reaches it. The narration script, including figures selected from your data.
Anthropic
United States
What it does. A configured alternative route for the same projection Gemini receives.
What reaches it. Nothing today. Credentials exist in production but this route is not in use, so it has received no customer information. It is listed because switching to it is one setting, and this page changes first.
Apple
United States
What it does. Sign in with Apple, App Store purchases, and iCloud platform services on your own device.
What reaches it. Your Apple account identifier when you choose that sign-in method, and purchase records. A video you save to your device is covered by your own iCloud settings.
Infrastructure and communications
These do not process your uploaded content. They run the website and app, deliver messages you asked for, and tell us when something breaks.
Vercel
United States
What it does. Website and web-app hosting.
What reaches it. Request logs, including IP address and request time.
Google — Firebase
United States
What it does. Google sign-in, crash reporting, app analytics, push-notification delivery, and consent-controlled website analytics.
What reaches it. Your Google sign-in identifier when you select Google sign-in; crash diagnostics; app feature events; device and operating-system information; your push-notification token; and, only after your affirmative consent through Allow analytics, website page views, basic feature-use events, referral information, and analytics identifiers. Website analytics excludes uploaded and user-authored content and is not linked to your Chartapir account.
Resend
United States
What it does. Transactional email — sign-in codes, finished-video notices, and waitlist confirmations.
What reaches it. Your email address and the contents of that message.
Stripe and Link
United States and other countries where they operate
What it does. Hosted checkout, payment processing, tax handling, receipts, subscription management, refunds, and fraud or dispute handling for web purchases through Stripe Managed Payments.
What reaches it. The Chartapir account identifier and email needed to associate a purchase, plus the payment and billing contact information you enter in Stripe Checkout. Chartapir does not receive your full card number.
Changelog
Every addition, removal, and change of role, in date order, newest first. A provider is added here before it receives anything.
- September 24, 2026 — Stripe and Link added. Web subscriptions can now be purchased through Stripe Checkout using Stripe Managed Payments. Stripe and Link receive billing information needed to process and manage those purchases; they do not receive uploaded files or generated videos.
- September 16, 2026 — website analytics added. The production website may now send page views and basic feature-use events to Firebase Analytics, but only after the visitor’s affirmative consent through Allow analytics. Uploaded content, user-authored content, and Chartapir account identifiers are excluded.
- September 16, 2026 — PostHog removed. Product analytics from the app went to PostHog as well as to Firebase. That second copy was retired and the Chartapir app no longer sends anything to PostHog. Firebase remains, and is now the only product-analytics recipient.
- September 16, 2026 — page published. First publication of this list. It records the providers in use on that date and is the baseline every later entry is a change from.
- September 16, 2026 — OpenRouter removed before it was ever used. An earlier version of our Privacy Policy described OpenRouter, and the model host it selects, as a configured alternative route for the data projection. Production has never held a credential for it, so it has never received customer information. It is not a subprocessor and is not listed above. If that changes, it appears here first.
Asking about this list
We have a data processing agreement prepared and will send it on request, along with a copy of this list as of a particular date or detail we have not published. Write to [email protected].
TechnicolorLife LLC
30 N Gould St Ste N
Sheridan, WY 82801
United States