Draft – pending legal review. Not in force until Victoriny AB has completed the stated factual checks and adopted a final version.
Supplier register
Version 2026-10-25 · Legal
This register separates (A) sub-processors of customers' personal data, (B) providers we use for our own purposes as controller, and (C) independent recipients such as connected platforms. Optional providers receive no data until their feature is switched on. We give at least 30 days' notice before adding or replacing a sub-processor (see the Data Processing Agreement). Last checked: [DATE VERIFIED].
| Provider | Role and function | Data | Locations, including remote access | Transfer safeguard |
|---|---|---|---|---|
| Supabase ([CONTRACTING ENTITY]) | A, B: database, sign-in, file storage, backups | All workspace and account data | EU (Stockholm) for the database; support and other flows [LOCATIONS] | [SAFEGUARD] |
| Vercel, Inc. | A, B: hosting of the app and server functions, including video rendering with the Remotion software, and logs | All data the app handles, while it is handled | Function region [REGION]; content delivery worldwide | [SAFEGUARD] |
| Resend ([CONTRACTING ENTITY]) | A, B: sign-in and service emails, receipt of replies to Artistwing reply addresses | Email addresses, message content | Sending from the EU (Ireland); other processing [LOCATIONS] | [SAFEGUARD] |
| Anthropic ([CONTRACTING ENTITY]) | A: AI text features, when enabled | The inputs needed for the task | [LOCATIONS] | [SAFEGUARD] |
| Features & Labels, Inc. (fal.ai) | A: AI image and video features, when enabled, only with the models listed here: [MODELS] | Prompts, reference images, generated media | [LOCATIONS] | [SAFEGUARD] |
| Cloudflare, Inc. | B: DNS for artistwing.com | [DATA, if any beyond DNS queries] | Worldwide | [SAFEGUARD] |
| Stripe | B and C: payments, invoices and tax; independent controller for some payment, fraud and regulatory purposes | Billing data | EU and USA | [SAFEGUARD] |
Software that runs on our own hosting, such as the Remotion rendering library, is not a sub-processor because its maker receives no customer content. The TinyFish browser service is not used with customers' data. Platforms you connect yourself (Meta, TikTok, Google/YouTube, Spotify) are independent recipients (C) under their own terms. Changes are notified to workspace owners by email.