Data Protection // Supply Chain

Sub-
processors.

Every third party that can process customer data on our behalf, what they do, where they process it, and how we notify you of changes.

Last updated: 14 August 2026 // Version 1.0 // Governing law: the laws of England and Wales

1. Current Sub-processors

Sub-processor	Function	Data processed	Processing location
Google Cloud Platform and Firebase (Google Cloud EMEA Limited, Ireland, with Google LLC, United States)	Application hosting, container runtime, Firestore database, file storage, secret management, logging	Account data, design content, uploads, generated Output, usage and metering records, technical logs	Primary region us-east4, Northern Virginia, United States
Google Gemini API (Google)	AI model inference for text, image and video generation	Briefs and prompts, refinement answers, uploaded reference images, document context	United States and other Google regions
Firebase Authentication (Google)	Account creation, sign-in, email verification and password reset email delivery	Email address, display name, hashed credential, sign-in metadata	United States
Google Analytics for Firebase (Google)	Product analytics, loaded only with your consent	Pseudonymous analytics identifiers, event and screen data, approximate location derived from IP	United States
Stripe (Stripe Payments Europe Limited, Ireland, with Stripe Inc, United States)	Card payment processing, subscription billing, invoicing, fraud prevention	Name, email address, billing country, card metadata, transaction and subscription records	European Union and United States

Web fonts are compiled into the application at build time and served from our own domain, so your browser does not make requests to a third-party font service.

2. Safeguards

Every sub-processor is engaged under a written contract that includes data protection terms at least as protective as ours.
Transfers out of the United Kingdom and the European Economic Area rely on the UK International Data Transfer Addendum and the European Commission Standard Contractual Clauses, and on the EU-US Data Privacy Framework where the recipient is certified.
Sub-processors are limited to the purposes described above and may not use customer data for their own purposes.
We use the paid Gemini API tier so that prompts and responses are not used to train general models.

3. Notice of Changes

This page is the authoritative list. Before we add or replace a sub-processor that handles customer content, we will update this page and, for customers with a Data Processing Addendum in place, give at least 30 days notice by email. If you reasonably object on data protection grounds within that period, you may terminate the affected subscription and we will refund the unused portion of the current period. To subscribe to change notifications, email privacy@seamix.ai.

1. Current Sub-processors

2. Safeguards

3. Notice of Changes

Related documents