Sub-processors
- Effective from
- September 26, 2026
- Version
- 2026-09-26
Kuro Studio uses the following sub-processors to provide its services to customers under the data processing agreement.
Scope
This list covers services that process personal data on behalf of our customers in every installation. Services that a customer connects with its own account (for example its email provider, advertising platforms, newsletter or analytics tools) are contracted by the customer directly and are not listed here.
Current sub-processors
| Provider | Purpose | Location and safeguard |
|---|---|---|
| VercelVercel Inc., USA | Website hosting, content delivery network and server functions | Global network (incl. USA)EU-US Data Privacy Framework and Standard Contractual Clauses |
| SupabaseSupabase, Inc., USA (database and file storage in Frankfurt, Germany) | Database, file storage and user authentication | EU/EEAEU Standard Contractual Clauses |
| ResendPlus Five Five, Inc. (Resend), USA | Sending transactional emails (confirmations, notifications) | USAEU Standard Contractual Clauses |
| Cloudflare TurnstileCloudflare, Inc., USA | Protecting forms against spam and automated abuse | Global network (incl. USA)EU-US Data Privacy Framework and Standard Contractual Clauses |
| OpenAIOpenAI Ireland Ltd., Ireland / OpenAI, L.L.C., USA | AI features in the CRM (text generation, translation) when a user starts them | USAEU-US Data Privacy Framework and Standard Contractual Clauses |
- VercelVercel Inc., USA
- Purpose
- Website hosting, content delivery network and server functions
- Location and safeguard
- Global network (incl. USA)EU-US Data Privacy Framework and Standard Contractual Clauses
- SupabaseSupabase, Inc., USA (database and file storage in Frankfurt, Germany)
- Purpose
- Database, file storage and user authentication
- Location and safeguard
- EU/EEAEU Standard Contractual Clauses
- ResendPlus Five Five, Inc. (Resend), USA
- Purpose
- Sending transactional emails (confirmations, notifications)
- Location and safeguard
- USAEU Standard Contractual Clauses
- Cloudflare TurnstileCloudflare, Inc., USA
- Purpose
- Protecting forms against spam and automated abuse
- Location and safeguard
- Global network (incl. USA)EU-US Data Privacy Framework and Standard Contractual Clauses
- OpenAIOpenAI Ireland Ltd., Ireland / OpenAI, L.L.C., USA
- Purpose
- AI features in the CRM (text generation, translation) when a user starts them
- Location and safeguard
- USAEU-US Data Privacy Framework and Standard Contractual Clauses
Changes
We inform our customers by email at least 30 days before adding or replacing a sub-processor. Customers can object within this period as described in the data processing agreement.