Processor List
Processors and Sub-processors
This list names the service providers that process personal data on CANTA's behalf, together with planned services that are not yet active. Role and transfer statements are reviewed on an ongoing basis; reviews in progress are flagged in the respective row.
Last updated: 2026-07-27
Active providers
| Service | Provider / location | Function | Role | Transfer / basis |
|---|---|---|---|---|
| Hetzner | Hetzner Online GmbH, Germany | Server and storage infrastructure; CANTA's self-hosted Supabase stack runs on it | Processor (infrastructure) | Processing in the EU; no third-country transfer |
| kie.ai | Operator per notice: NEXUSAI SERVICES LLC / INNOLEAP AI LLC, Denver, Colorado, USA | Song-generation gateway; receives the submitted lyric/message text | Processor (assumed) | USA. Per its own documentation, media files are auto-deleted after ~14 days and text/metadata logs after ~2 months. Kie.ai cannot produce a DPA or binding data commitments; CANTA cannot represent any kie.ai commitment. |
| Stripe | Stripe, LLC, USA (contracting entity for the US-based operator; Stripe Payments Europe, Ltd. is not a party here) | Payment processing: Stripe-hosted payment page, receipts, tax calculation; card details and billing address are held by Stripe only | Processor for payment processing on CANTA's behalf; independent controller for fraud prevention, statutory checks, and compliance | USA. Stripe data processing agreement incorporated automatically; transfers from the EU under the Data Transfers Addendum: primarily the EU-US Data Privacy Framework (certification declared by Stripe), with EU Standard Contractual Clauses as fallback |
| Resend | Plus Five Five, Inc., San Francisco, California, USA | Sending account emails (e.g. one-time sign-in codes) | Processor | USA — all send data (content, metadata, logs) is stored in the USA, even when the EU sending region is used. Data processing agreement with EU Standard Contractual Clauses incorporated automatically; the provider declares certification under the EU-US Data Privacy Framework. Send data is deleted after 30 days; full deletion within 90 days after the contract ends |
| Suno | Suno Inc., Cambridge, Massachusetts, USA | Underlying music model; today reached only indirectly via kie.ai | Upstream provider (becomes a processor if Suno-direct goes live) | USA, indirectly via kie.ai; no direct transfer by CANTA as things stand |
| Groq | Groq LLC, Mountain View, California, USA | Fallback for voice transcription | Processor | USA. DPA in force (incorporated into CANTA's agreement); EU Standard Contractual Clauses; no training on the data; Zero Data Retention is enabled for CANTA's account (inputs and outputs are not stored) |
| Cloudflare Turnstile | Cloudflare, Inc., USA | Bot/abuse protection on the input pages (only when enabled) | Processor for site protection; separate controller for product improvement | USA / global network. DPA in place; active only when Turnstile is switched on |
| PostHog | PostHog, Inc., San Francisco, USA (EU Cloud: Frankfurt; no EU establishment) | Product analytics. EU Cloud sub-processors: Amazon Web Services, Wiz, PlanetScale, Modal Labs — routed through Germany; Cloudflare sits on the global edge regardless of the region chosen | Processor | Processing on the EU Cloud (Frankfurt). Because the provider is a US company with no EU establishment and Cloudflare remains in the chain regardless of region, access from the USA is possible; the provider's EU Standard Contractual Clauses apply to it, supplemented by a certification under the EU-US Data Privacy Framework that the provider declares. The measurement stores nothing on the device and reads nothing from it |
Transfers to the USA, where they occur, rely on each provider's EU Standard Contractual Clauses (SCC). For kie.ai no such mechanism is publicly verifiable.
CANTA is made with AI.
Last updated: 2026-07-27