Subprocessors
Last updated: October 21, 2026
Plugin Play LLC (doing business as Brevidy) uses the subprocessors below to provide the Brevidy Services. This list forms Annex 3 of our Data Processing Addendum (and Annex III of the Standard Contractual Clauses). For how we protect data, see Security.
Not every subprocessor receives every category of customer personal data. Feature-specific providers receive customer content only when your users use the relevant feature. Each subprocessor is bound by data processing terms, which for these providers form part of their standard customer agreements.
Current Subprocessors
| # | Subprocessor | Location of processing | Purpose | Customer personal data received |
|---|---|---|---|---|
| 1 | Supabase, Inc. (hosted on Amazon Web Services) | United States (AWS us-west-1, Northern California) | Primary database, authentication, file storage for uploaded audio/video, backend services | Account and authentication data; job records; uploaded audio and video; transcripts, captions and AI inputs/outputs; operational metadata |
| 2 | Vercel Inc. | United States | Hosting and execution of the web application and API, CDN, scheduled jobs, runtime logs | All data passing through the API in transit and in short-lived function memory; request logs (IP address, URL, user agent) |
| 3 | Eleven Labs Inc. and affiliates | United States | Speech-to-text transcription (Scribe), the default transcription engine; real-time speech-to-text for the optional voice dictation feature in Preset Studio (streamed directly from the user's computer) | Extracted audio; transcripts and timing data; dictation audio (if used) |
| 4 | Gladia (Glad Technologies SAS) | France (EU) | Speech-to-text transcription for the transcription model that uses Gladia | Extracted audio; custom vocabulary; transcripts and timing data |
| 5 | AssemblyAI, Inc. | United States | Speech-to-text transcription for the transcription model that uses AssemblyAI | Extracted audio; transcripts and timing data |
| 6 | OpenRouter, Inc., and the model providers it routes to (currently OpenAI, L.L.C.; Anthropic, PBC; Google LLC) | United States | Large-language-model processing for AI features (AutoCut, highlight and clip suggestions, emoji and media suggestions, Preset Studio, and the AI editing agent if enabled) | Transcript text or excerpts, prompts and instructions, timeline and project metadata; for the AI agent, still frames from the sequence if the user asks the agent to look at the video |
| 7 | Modal Labs, Inc. | United States | GPU media processing for AutoCrop / reframing | Rendered video proxy of the sequence; optional custom prompt |
| 8 | Functional Software, Inc. d/b/a Sentry | United States | Error monitoring, performance tracing, and error-triggered session replays | User ID and email address, IP address, browser and OS details, error context and diagnostic metadata; masked session replays of the web dashboard |
| 9 | Resend, Inc. | United States | Transactional, lifecycle and support email delivery and inbound support email | Name, email address, email content |
| 10 | UAB MailerLite | European Union (Lithuania) | Account email audience management | Name, email address, subscription status and plan |
| 11 | Google LLC (Google Workspace) | United States | Company email and document storage for support and account communications | Support correspondence and contact details |
| 12 | Stripe, Inc. and affiliates | United States and other Stripe locations | Subscription billing and payment processing | Billing contact details, subscription status, transaction metadata (we never receive full card numbers) |
Not Subprocessors
The following receive data in connection with our own business purposes, for which we are an independent controller, and do not process customer content:
- Marketing measurement: Google (Google Tag Manager, Google Analytics including a server-side tagging endpoint, Google Ads conversion measurement), Microsoft Advertising (conversion measurement using a hashed email address), and Meta (Meta Pixel), used to measure our own marketing. See the Privacy Policy.
- Media sources and asset CDNs: Giphy, Pexels, Pixabay, Openverse and Unsplash, and emoji/font CDNs, receive only search terms or asset requests and no customer personal data.
- Your own computer: processing that happens only on your computer inside Adobe Premiere Pro (audio extraction, optional speaker separation, locally cached transcripts) is under your control and involves no subprocessor.
Changes to This List
We will inform customers at least 14 days before adding or replacing a subprocessor, by updating this page and by email to the account owner or administrator, as described in Section 9 of the Data Processing Addendum. Customers can object on data protection grounds within that period. To have notices sent to a designated privacy contact, email admin@pluginplay.app.