Subprocessor List

Version: 1.0
Last updated: 27 July 2026
Applies from: 27 July 2026

We use the following subprocessors to provide Yubano. This list covers providers that may process Customer Personal Data when we act as a processor for a business customer. It may also help all users understand our privacy data flows.

Provider	Purpose	Customer data involved	Processing/storage region	Transfer safeguard	Status/notes
fal.ai, Inc.	AI image, video, and audio generation	Prompts, uploaded assets, generated content, technical metadata	United States	Standard Contractual Clauses	Receives prompts and uploaded assets to generate media
OpenRouter, Inc.	LLM routing (routes prompts to underlying model providers such as OpenAI, Anthropic, and Google)	Prompts, conversation/project context, tool results, Outputs where included	United States	Standard Contractual Clauses	Routes requests to the selected underlying model provider
Railway Corporation	PostgreSQL database and Redis	Accounts, projects, content records, credit ledger, metadata	United States	Standard Contractual Clauses	—
Cloudflare, Inc. (R2)	Object/media storage and delivery	Uploaded and generated media, object metadata	Global; EU-jurisdiction bucket	Standard Contractual Clauses	—
Langfuse GmbH	Observability and tracing	Prompts, Outputs, tool calls, errors, performance and usage metadata	European Union (EU Cloud)	processed within the EEA	Traces retained for 30 days
Tavily, Inc.	Web search for user-invoked agent research	Search queries, contextual snippets, request metadata	United States	Standard Contractual Clauses	—
Resend	Verification, password reset, transactional email	Name, email, message metadata/content	United States	Standard Contractual Clauses	—
Railway Corporation	Application/API hosting, networking, and logging	Potentially all data in transit; app and infrastructure logs	United States	Standard Contractual Clauses	—
Google LLC	OAuth sign-in	Account identifiers, login/security data	United States	Standard Contractual Clauses	Better Auth stores users in our own database and is not a separate processor
None currently	Customer support	Account, communications, attachments	Not applicable	Not applicable	No third-party support provider is currently used
PostHog, Inc.	Product analytics	Device, cookie, consent and usage data	European Union (EU Cloud)	processed within the EEA	—

Payment provider and independent controller

PayPal is not listed as a Subprocessor for the current payment flow because PayPal generally acts as an independent controller for its payment services. PayPal independently determines how it processes payment credentials and transaction data for payment execution, fraud prevention, identity verification, regulatory compliance, service improvement, and other purposes described in its applicable .

Provider	Relationship and purpose	Data exchanged	Notes
PayPal	Independent payment-services controller; checkout, payment execution, refunds, disputes, fraud prevention, and regulatory compliance	We send order amount, currency, internal order/reference ID, description, and return/callback details. PayPal may return payer name/email, transaction and payer IDs, status, amount/currency, and—depending on configuration—address/phone details. We do not receive full card or bank credentials from PayPal.	PayPal acts as an independent controller for payment processing under its own terms and Privacy Statement

If a future PayPal or Braintree product makes PayPal a processor for a separate activity, we will add the applicable PayPal entity and that activity to the Subprocessor table above based on the signed agreement.

Changes and objections for business customers

We will post updates to this page. For customers with an executed DPA, we will provide at least 30 days’ advance notice before authorizing a new subprocessor that will process Customer Personal Data, except where an urgent replacement is needed for security, legal compliance, or service continuity. Customers may subscribe to updates by emailing .

A customer may object on reasonable data-protection grounds by contacting within 15 days after notice. The parties will work in good faith on a commercially reasonable solution. If none is available, the customer may terminate the affected Service as provided in the DPA or order form. This right is not a general veto over vendors.

Contact

Questions about subprocessors or transfer safeguards: