Legal · Updated October 5, 2026
Sub-Processors
In accordance with GDPR Article 28, this page lists the third-party sub-processors that Audora (operated by Metalmedia Group i Sverige AB) engages to deliver its services. Each sub-processor has been assessed for appropriate data protection measures.
1. Infrastructure & Database
Supabase Inc.
Purpose: Database hosting (PostgreSQL), authentication, file storage, edge functions
Data processed: User accounts, profiles, content metadata, file storage, authentication tokens
Location: AWS EU-North (Stockholm, Sweden)
DPA: supabase.com/legal/dpa
Netlify Inc.
Purpose: Frontend hosting, CDN, deployment
Data processed: Static website assets, access logs (IP addresses)
Location: Global CDN with primary servers in USA/EU
DPA: netlify.com/pdf/netlify-dpa.pdf
Cloudflare Inc. (R2)
Purpose: Off-site backup of files artists upload and of the database (encrypted)
Data processed: Copies of the files artists upload and of the database
Location: European Union (EU jurisdiction)
DPA: cloudflare.com/cloudflare-customer-dpa
2. Payments
Stripe Inc.
Purpose: Payment processing, subscription management, payouts
Data processed: Payment card details (PCI DSS compliant — Audora never handles raw card data), billing address, transaction history
Location: USA with EU data residency options
DPA: stripe.com/legal/dpa
3. Email & Communications
Resend Inc.
Purpose: Transactional and newsletter email delivery
Data processed: Email addresses, email content, delivery status
Location: USA
DPA: resend.com/legal/dpa
4. Analytics
Google LLC (Google Analytics 4)
Purpose: Website analytics, usage patterns, performance monitoring
Data processed: Anonymized usage data, page views, device/browser info, cookies
Location: USA (with EU adequacy measures via Standard Contractual Clauses)
DPA: Google Data Processing Terms
Note: GA4 is only loaded with explicit user consent (cookie banner) and is suppressed when Global Privacy Control (GPC) is detected.
5. AI & Machine Learning
Audora uses AI services to power creative tools (text generation, image generation, video generation). User content sent to these services is used only for immediate processing and is not used to train their models.
OpenAI Inc.
Purpose: Text generation (marketing copy, bios, descriptions)
Data processed: User prompts, artist profile context, generated text
Location: USA
DPA: openai.com/policies/data-processing-addendum
Anthropic PBC
Purpose: Text generation (alternative AI provider); looking up what an applying artist has already published, by searching and reading the public web (Privacy Policy, section 2.6)
Data processed: User prompts, artist profile context, generated text; for look-ups, the artist name, the link and application note the artist gave, and public web pages about the artist
Location: USA
DPA: anthropic.com/legal/commercial-terms
Google LLC (Vertex AI / Gemini)
Purpose: Text and content generation
Data processed: User prompts, artist profile context, generated content
Location: EU (europe-west1) / USA
DPA: Google Cloud DPA
Replicate Inc.
Purpose: AI video and image generation
Data processed: User prompts, input images, generated media
Location: USA
DPA: replicate.com/privacy
6. Changes to This List
We may update this sub-processor list from time to time as we add or change service providers. Material changes will be communicated via the platform. If you have concerns about a specific sub-processor, please contact us at hello@audora.music.
7. Legal Basis
All sub-processors are engaged under appropriate data processing agreements (DPAs) in compliance with GDPR Article 28. For transfers outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, adequacy decisions, or other lawful transfer mechanisms.