1. About this page
A subprocessor is a third-party service that processes personal information on our behalf to help operate the Services. This page lists the subprocessors Portals currently engages, the purpose of each engagement, the categories of personal information each one handles, and where to read their own privacy policies.
This list is the canonical version referenced by our Privacy Policy and Cookie Policy. It is maintained as part of the repository that runs Portals and is updated when we add or remove a vendor that processes user data.
2. Current subprocessors
| Subprocessor | Purpose | Data categories | Location | Privacy policy |
|---|---|---|---|---|
| Amazon Web Services | Cloud hosting and S3 object storage for user-uploaded assets. | Account and content data at rest; user-uploaded media (images, models, audio); server logs. | United States | aws.amazon.com/privacy |
| Anthropic | Large language model inference for AI Lab features. | Prompts submitted to the AI Lab and resulting AI Outputs. | United States | anthropic.com/legal/privacy |
| Twilio SendGrid | Transactional and marketing email delivery (account verification, password resets, security notifications, product messaging). | Email address, user ID, display name, messaging preferences. | United States | twilio.com/en-us/legal/privacy |
| ElevenLabs | Text-to-speech and voice generation for AI Lab features. | Text prompts submitted for speech synthesis and the resulting audio outputs. | United States | elevenlabs.io/privacy-policy |
| Google Analytics / Google Tag Manager | Website analytics and tag management. | IP address (truncated), device and browser type, referring URL, pages and features viewed, pseudonymous identifiers. | United States | policies.google.com/privacy |
| Google Cloud Platform (Firebase) | Authentication, Firestore database, and Cloud Storage for account and application data. Also hosts the Imagen image model accessed via Replicate. | Account credentials and session tokens, profile data, application data at rest, and user-uploaded content stored via Firebase. | United States | policies.google.com/privacy |
| Mixpanel | Product analytics and event instrumentation. | Pseudonymous device and user identifiers, event properties, device and browser metadata, and IP address. | United States | mixpanel.com/legal/privacy-policy |
| Replicate | Hosted inference for image, 3D, and other generative AI models (including Google Imagen and third-party open models). | Prompts submitted to the AI Lab and resulting AI Outputs. | United States | replicate.com/privacy |
| Stripe | Payment processing for subscriptions, credit purchases, and Marketplace checkout; Stripe Connect for creator payouts. | Name, billing address, email, tax information, payment-card details (tokenized — Portals does not receive full card numbers), transaction data, dispute and fraud signals, and — for Creators — identity and bank-account information required for payouts. | United States | stripe.com/privacy |
| Tripo (VAST AI) | 3D-asset generation for AI Lab features. | Prompts or reference images submitted for 3D generation and the resulting 3D outputs. | United States / China | tripo3d.ai/privacy |
Amazon Web Services
- Purpose
- Cloud hosting and S3 object storage for user-uploaded assets.
- Data categories
- Account and content data at rest; user-uploaded media (images, models, audio); server logs.
- Location
- United States
- Privacy policy
- aws.amazon.com/privacy
Anthropic
- Purpose
- Large language model inference for AI Lab features.
- Data categories
- Prompts submitted to the AI Lab and resulting AI Outputs.
- Location
- United States
- Privacy policy
- anthropic.com/legal/privacy
Twilio SendGrid
- Purpose
- Transactional and marketing email delivery (account verification, password resets, security notifications, product messaging).
- Data categories
- Email address, user ID, display name, messaging preferences.
- Location
- United States
- Privacy policy
- twilio.com/en-us/legal/privacy
ElevenLabs
- Purpose
- Text-to-speech and voice generation for AI Lab features.
- Data categories
- Text prompts submitted for speech synthesis and the resulting audio outputs.
- Location
- United States
- Privacy policy
- elevenlabs.io/privacy-policy
Google Analytics / Google Tag Manager
- Purpose
- Website analytics and tag management.
- Data categories
- IP address (truncated), device and browser type, referring URL, pages and features viewed, pseudonymous identifiers.
- Location
- United States
- Privacy policy
- policies.google.com/privacy
Google Cloud Platform (Firebase)
- Purpose
- Authentication, Firestore database, and Cloud Storage for account and application data. Also hosts the Imagen image model accessed via Replicate.
- Data categories
- Account credentials and session tokens, profile data, application data at rest, and user-uploaded content stored via Firebase.
- Location
- United States
- Privacy policy
- policies.google.com/privacy
Mixpanel
- Purpose
- Product analytics and event instrumentation.
- Data categories
- Pseudonymous device and user identifiers, event properties, device and browser metadata, and IP address.
- Location
- United States
- Privacy policy
- mixpanel.com/legal/privacy-policy
Replicate
- Purpose
- Hosted inference for image, 3D, and other generative AI models (including Google Imagen and third-party open models).
- Data categories
- Prompts submitted to the AI Lab and resulting AI Outputs.
- Location
- United States
- Privacy policy
- replicate.com/privacy
Stripe
- Purpose
- Payment processing for subscriptions, credit purchases, and Marketplace checkout; Stripe Connect for creator payouts.
- Data categories
- Name, billing address, email, tax information, payment-card details (tokenized — Portals does not receive full card numbers), transaction data, dispute and fraud signals, and — for Creators — identity and bank-account information required for payouts.
- Location
- United States
- Privacy policy
- stripe.com/privacy
Tripo (VAST AI)
- Purpose
- 3D-asset generation for AI Lab features.
- Data categories
- Prompts or reference images submitted for 3D generation and the resulting 3D outputs.
- Location
- United States / China
- Privacy policy
- tripo3d.ai/privacy
3. How we update this list
We evaluate new tools from time to time. When we add, remove, or materially change a subprocessor, this page is updated in the same code change that enables the vendor in production. Material changes will be reflected in the “Last updated” date above.
Changes that result in a new category of personal data being shared (for example, adding a new class of analytics or AI provider) are also summarized in the Privacy Policy and, where relevant, the Cookie Policy.
4. Contact
Questions about our subprocessors or how your data is handled? Email privacy@theportal.to.