Sub-processors
In accordance with Article 28(2) GDPR, this page lists the third parties that may process personal data on our behalf when you use the Sociaro gateway. We keep it current and update it when we add or replace a sub-processor.
What actually travels. Sociaro operates a transparent proxy. Requests you send are forwarded to the model provider you addressed, unmodified, and the response is returned to you. We do not rewrite prompts and we do not route your request to a provider you did not ask for.
You choose where inference happens. Accounts can run in EU-only mode, where requests are served exclusively by EU inference endpoints, or in global mode, which opens the full catalogue including providers outside the EU. The gateway itself — request handling, accounting and the database — runs in the EU in both cases.
Model providers and inference
These process the content of your request — the prompt, any reference images, audio or video you attach — for the sole purpose of producing the output you asked for. Which of them are reachable depends on your account's inference mode and on the models you call.
Video, image and language generation (Seedance, Seedream, Seed models). Sociaro is an official partner.
- Data
- Prompt text, reference media you attach, generation parameters
- Mode
- Global
- Transfer basis
- Outside the EEA · Standard Contractual Clauses per the provider's terms
- Retention
- BytePlus Privacy Policy ↗
Video and image generation (Wan, Qwen-Image) and the Qwen language models. Sociaro is an official partner.
- Data
- Prompt text, reference media you attach, generation parameters
- Mode
- Global
- Transfer basis
- Outside the EEA · Standard Contractual Clauses per the provider's terms
- Retention
- Alibaba Cloud Privacy Policy ↗
Language and image generation through Vertex AI.
- Data
- Prompt text, reference media you attach, generation parameters
- Mode
- EU-only when an EU region is configured for your account; otherwise global
- Transfer basis
- EEA when an EU region is used · otherwise Standard Contractual Clauses per the Google Cloud DPA
- Retention
- Google Cloud DPA ↗
Video generation.
- Data
- Prompt text, reference media you attach, generation parameters
- Mode
- Global
- Transfer basis
- Outside the EEA · Standard Contractual Clauses per the provider's terms
- Retention
- Kling API terms ↗
Video generation.
- Data
- Prompt text, reference media you attach, generation parameters
- Mode
- Global
- Transfer basis
- Outside the EEA · Standard Contractual Clauses per the provider's terms
- Retention
- PixVerse Privacy Policy ↗
Image generation.
- Data
- Prompt text, reference media you attach, generation parameters
- Mode
- Global
- Transfer basis
- Outside the EEA · Standard Contractual Clauses per the provider's terms
- Retention
- Recraft Privacy Policy ↗
GPU infrastructure for models Sociaro runs itself rather than calling a vendor API.
- Data
- Prompt text and reference media, processed in memory for the duration of the job
- Mode
- Depends on the region configured for the workload
- Transfer basis
- Depends on the region of the workload · Standard Contractual Clauses where outside the EEA
- Retention
- Not retained by the compute node after the job completes
Infrastructure
Hosts the gateway and its database. All request handling and accounting happen here.
- Data
- Account and key records, usage and billing records, request metadata
- Location
- Helsinki, Finland (EU)
- Transfer basis
- Within the EEA · no transfer
- Retention
- See Privacy Policy
Network access to the gateway, this website, and object storage (R2) for generated assets.
- Data
- Connection metadata in transit; generated images and video stored in R2 on your behalf
- Location
- Global edge network; R2 bucket region as configured
- Transfer basis
- Standard Contractual Clauses per the Cloudflare DPA
- Retention
- Assets remain until you delete them · Cloudflare GDPR hub ↗
Payments
Card payments, invoicing and subscription management. Sociaro never sees or stores full card details.
- Data
- Billing name and address, email, payment method details, transaction history
- Location
- EU and United States (EU–US Data Privacy Framework)
- Transfer basis
- EU–US Data Privacy Framework, with Standard Contractual Clauses as fallback
- Retention
- Stripe Privacy Center ↗, plus statutory accounting periods
Communications
Transactional email — account notices, key delivery, billing and service messages.
- Data
- Email address, message content
- Location
- United States
- Transfer basis
- Standard Contractual Clauses per the Resend DPA
- Retention
- Resend Privacy Policy ↗
Changes to this list
We update this page when we add, replace or remove a sub-processor. Customers with a signed Data Processing Agreement receive advance notice of additions as set out in that agreement, and may object on reasonable data-protection grounds.
Questions
Write to dpo@sociaro.com. If you need a signed Data Processing Agreement or a completed security questionnaire, ask and we will send one.
Sociaro Baltic OÜ · Registry code 16252815 · Karu tn 14-8, Kesklinna linnaosa, 10120 Tallinn, Estonia