A sub-processor is a company that processes personal data on JARAI's behalf. This page lists every one that receives personal data from the JARAI STUDIO platform: what it receives, where it processes it, and the legal basis for any transfer outside the United Kingdom. It is the list our Privacy Policy refers to.
1. AI model providers
These providers receive the content you configure — prompts and text, and reference images, audio or video where a production step needs them — to generate media. Each has signed data processing terms with us. The list comes from the platform's provider register, which the platform enforces: a provider that is not permitted to receive personal data is refused any request that carries it.
| Provider | What it does for us | Where | Transfer basis |
|---|---|---|---|
| Anthropic | Language and vision models | United States | UK adequacy (UK–US data bridge) |
| Amazon Web Services (Polly) | Speech synthesis | United Kingdom (London) | Not needed — processed in the UK |
| ElevenLabs | Speech synthesis, and voice cloning from recordings an operator has approved and attested | United States | UK adequacy (UK–US data bridge) |
| Language, vision and image models | United States | UK adequacy (UK–US data bridge) | |
| Google Cloud (Vertex AI) | Google models run in Google Cloud | United Kingdom (London) | Not needed — processed in the UK |
| Microsoft (Azure AI services) | Language and vision models | United States | UK adequacy (UK–US data bridge) |
| OpenAI | Language and vision models | United States | UK adequacy (UK–US data bridge) |
| Runway | Image-to-video animation | United States | UK adequacy (UK–US data bridge) |
| Shotstack | Video assembly and rendering | United States | UK adequacy (UK–US data bridge) |
2. Other processors
| Processor | What it receives | Where | Transfer basis |
|---|---|---|---|
| Microsoft Azure | All platform data: hosting, databases, storage, sign-in (Entra External ID), content-safety screening and monitoring | United Kingdom (UK South) | Not needed — processed in the UK |
| Microsoft Azure Static Web Apps | The files of our websites and browser applications, and the requests your browser makes for them (IP address, browser details) | West Europe, delivered through Microsoft’s global network | UK adequacy (EEA) |
| Microsoft Azure Communication Services | Notification e-mails and SMS: your e-mail address or phone number and the message | Europe | UK adequacy (EEA) |
| Microsoft Azure Maps | The IP address of a sign-in, to show an approximate location in the new-sign-in alert | Microsoft’s global service (not pinned to a region) | UK adequacy (UK–US data bridge) |
| Stripe | Billing identity, payment method and invoices | United States and Ireland | UK adequacy (UK–US data bridge); UK adequacy (EEA) |
| Zoho Mail | E-mail sent to our support, legal and data-protection addresses | European Union | UK adequacy (EEA) |
| Google (Sign in with Google) | Your name, e-mail address and Google account id, if you choose to sign in with Google | United States | UK adequacy (UK–US data bridge) |
| Cloudflare (Turnstile) | Browser challenge data when you register, to keep automated sign-ups out | Cloudflare’s global network | UK adequacy (UK–US data bridge) |
For the processors in this table, the transfer basis shown is the provider's own published position, such as its certification under the EU–US Data Privacy Framework and its UK extension.
3. What the transfer bases mean
- UK adequacy (UK–US data bridge): the UK's adequacy regulations for United States organisations certified under the UK extension to the EU–US Data Privacy Framework.
- UK adequacy (EEA): the UK's adequacy regulations for the European Economic Area.
- Not needed: the data is processed in the United Kingdom.
Where none of these applies, a transfer needs the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. No processor on this page relies on either today.
4. Providers that receive no personal data
We also use AIVA, Loudly, Mubert, Pexels, Pixabay, Stability AI, Suno, Udio for music, stock media and image generation. They are only sent requests that carry no personal data — a music style or a stock-image search term, for example — so they are not sub-processors of personal data. Cloudflare Web Analytics measures visits to our websites without cookies or personal identifiers; see our Cookie Policy.
5. Changes to this list
When we add or replace a sub-processor, we update this page and its version, and the change log below records it. Questions about any processor, or a request for a copy of a safeguard we rely on: contact us, or e-mail privacy@jarai.studio.
Change log
Each version of this page and what changed in it, newest first. Rows dated before 5 October 2026 are edits made in place before our legal pages were versioned, listed from the site's history so that every change is on the record.
| Version | Date | Change |
|---|---|---|
| 1.0 | First published. |