Subprocessors

A subprocessor is a company that processes personal data on Getuser’s behalf and only on our instructions: a Prosesor Data Pribadi under Indonesia’s Personal Data Protection Law (UU PDP), and a processor under the GDPR. Each one is bound by a written data processing agreement that requires it to keep the data confidential and secure and to use it only to provide its service to us.

• Current: in use today.
• Planned: we intend to use it; we will change its status here before it receives any data.
• Only if switched on: off today; we may turn it on, and will change its status here first.
• Only if you use it: it receives your data only if you choose the feature it provides.

Your data is stored in Singapore. Every provider below is a US company, so data may also be accessed from the US or elsewhere for support and security. For people in Indonesia, this is a transfer of Personal Data outside the jurisdiction of the Republic of Indonesia, protected by the safeguards in UU PDP art. 56(3); for people in the EU and the UK, by standard contractual clauses. The Privacy Policy explains this in full.

Supabase, Inc. (United States)

• Status: Current. Listed since 16 October 2026.
• What it does: Getuser’s database, sign-in (Supabase Auth), file storage, backups and logs.
• Data: all account and content data: your email address, sign-in records (IP address, browser and device type), app profile answers, uploads, videos, schedule and results, acceptance records and usage statistics.
• Where: Amazon Web Services, region ap-southeast-1 (Singapore). Supabase staff may access data from other countries to support and secure the service.
• Safeguard: Supabase’s data processing agreement, including standard contractual clauses. Privacy policy: supabase.com/privacy.

Railway Corporation (United States)

• Status: Current. Listed since 16 October 2026.
• What it does: runs Getuser’s web app and the render worker that makes your videos, and keeps application logs.
• Data: requests to the app (IP address, browser and device type), application logs, and your files and video details while a video is being rendered (temporary files are deleted at the end of each job).
• Where: Railway’s Southeast Asia region (Singapore). Railway staff may access data from other countries to support and secure the service.
• Safeguard: Railway’s data processing agreement, including standard contractual clauses. Privacy policy: railway.com/legal/privacy.

An email delivery provider, for example Resend, Inc. (United States)

• Status: Planned, for sign-in emails. We will name the provider chosen here before it sends any email. Until then, sign-in emails are sent through Supabase (above). Listed since 16 October 2026.
• What it does: sends sign-in links and codes, and other service emails.
• Data: your email address, the content of the email (the sign-in link or code) and delivery records, such as the time and whether it was delivered.
• Where: United States.
• Safeguard: the provider’s data processing agreement, including standard contractual clauses. For Resend: resend.com/legal/privacy-policy.

Cloudflare, Inc. (United States)

• Status: Planned, for Getuser’s domain name (listed since 16 October 2026). Turnstile only if switched on (listed since 19 October 2026).
• What it does: DNS: it answers lookups that turn Getuser’s domain name into the address of our servers. Turnstile: a check on the sign-up and password reset forms that tells people from bots, without a puzzle in most cases.
• Data: for DNS, technical data in those lookups, such as the IP addresses of the devices or networks that look up Getuser’s domain. For Turnstile, your IP address and information about your browser and device (such as its user agent, settings and how the form is used), collected by Cloudflare’s script while you fill in the form. Neither receives your account data or files. If we ever route Getuser’s traffic through Cloudflare’s network, we will update this entry first.
• Where: Cloudflare’s global network.
• Safeguard: Cloudflare’s data processing agreement, including standard contractual clauses. Privacy policy: cloudflare.com/privacypolicy.

Cloudflare, Inc. (R2 storage) (United States)

• Status: Planned, for file storage. Until then, files stay with Supabase (above). Listed since 19 October 2026.
• What it does: stores your uploads and finished videos and serves them to you, and to Instagram or TikTok when you post through Getuser, through private links that work for a limited time.
• Data: your uploads (screen recordings, endings, your own clips, images and music, which may show faces, voices and what is on your screen) and the videos and slides Getuser makes from them.
• Where: we will state the storage region here before any file moves.
• Safeguard: Cloudflare’s data processing agreement, including standard contractual clauses. Privacy policy: cloudflare.com/privacypolicy.

Functional Software, Inc. (Sentry) (United States)

• Status: Only if switched on. Off today. Listed since 16 October 2026.
• What it does: error monitoring: reports of errors on Getuser’s servers, so we can fix them. It runs only on our servers, never in your browser.
• Data: technical details of an error (what failed, where in the code, the page or task involved). It is set up not to collect personal data such as IP addresses, cookies or user details by default, though a report may contain an account or workspace ID. Reports are kept for 30 days.
• Where: the United States or the EU (Germany); we will state which here when we switch it on.
• Safeguard: Sentry’s data processing agreement, including standard contractual clauses. Privacy policy: sentry.io/privacy.

OpenRouter, Inc. (United States)

• Status: Only if you use it: when you ask Getuser to write a slideshow, a caption, lines or answers about your app. Listed since 17 October 2026.
• What it does: passes the request to GPT-6 Luna, an AI model made by OpenAI (United States), and returns its answer. Luna writes the words of a slideshow, caption suggestions for your posts, new lines and the answers about your app you left empty.
• Data: your answers about your app (its name, what it is, who it is for, the problem it solves, what makes it different, where to get it), your replies to its questions about your app, the post’s line or slide text, the lines you already have, the tone, language and hashtags you picked, caption parts you wrote yourself, and short examples from captions you approved. Never your email address, files or videos.
• Where: the United States, and wherever OpenAI runs the model.
• Safeguard: OpenRouter’s terms, with prompt logging and the use of our data to improve its products switched off, and routing limited to model providers that do not train on the data. Privacy policies: openrouter.ai/privacy, openai.com/policies/privacy-policy.

Google LLC (United States)

• Status: Only if you use it: when you choose to sign in with Google. Listed since 16 October 2026.
• What it does: signs you in with your Google account.
• Data: Google sends Getuser your email address, name and profile picture, and Google learns that you signed in to Getuser.
• Where: Google’s global infrastructure.
• Safeguard: for your Google account, Google acts under its own terms and privacy policy, and the transfer happens because you ask for it. If you prefer, sign in with an email link or code instead. Privacy policy: policies.google.com/privacy.

Instagram and TikTok are not our subprocessors. They do not process data for us; when you connect an account and post through Getuser, we send them what you chose, because you asked us to, and they handle it under their own terms and privacy policies, as independent controllers.

Meta Platforms (Instagram)

• When: only if you connect an Instagram professional account and post or schedule to it through Getuser.
• What it receives: the video or slides, caption and settings of each post you confirm, sent at the time you chose, and the fact that you use Getuser. Instagram fetches the files from private links that work for a few hours. For a video that shows a persona, the post carries Instagram’s AI label.
• What Getuser receives from it: the account’s ID, username, name, profile picture link and account type, and the access keys Getuser needs to post, stored encrypted.
• Privacy policy: facebook.com/privacy/policy.

TikTok

• When: only if you connect a TikTok account and post or schedule to it through Getuser.
• What it receives: the video or photos, caption, title and settings of each post you confirm (who can see it, interactions, commercial-content disclosure, AI label), sent at the time you chose, and the fact that you use Getuser. TikTok may fetch the file from a link on Getuser’s own website that works only for that file and only for a few hours.
• What Getuser receives from it: your account’s ID, display name and profile picture link, the access keys Getuser needs to post (stored encrypted) and, while you post, the privacy and interaction settings your account allows.
• Privacy policy: tiktok.com/legal/page/global/privacy-policy/en.

Disconnecting an account on the Accounts page stops all of this for that account. Posts already published stay on the platform until you delete them there.

• GitHub hosts Getuser’s source code only and receives no customer data.
• Instagram and TikTok receive only the posts you send through Getuser, as described under “Platforms you post to”. Facebook, YouTube and other platforms receive nothing from Getuser: you download your videos and post them yourself, under those platforms’ own terms.
• Payment providers: Getuser takes no payments today. Before it does, the providers (Midtrans in Indonesia, and later Dodo Payments for payments from abroad) will be added here, with notice.

We keep this page up to date; the date at the top shows when it last changed.

Before a provider listed above as Planned or Only if switched on starts receiving personal data, we change its status here. Before we add a subprocessor that is not listed here, or move data to a new country, we will tell you by email or in the app at least 30 days before the change takes effect, and update this page.

If you object to a change, write to privacy@getuser.app before it takes effect. If we cannot address your concern, you can download your data and close your account from Settings before the change applies.

Write to privacy@getuser.app. You can ask us for a copy of the safeguards (the transfer terms in the data processing agreements) that protect your data.