Subprocessor List

Subscribe to change notifications

Amazon Web Services, Inc.

All primary infrastructure: PostgreSQL (RDS), object storage (S3), queues (SQS), transactional email (SES), Lambda (Remotion video rendering), CloudWatch (metrics/logs) – USA (us-east-1)

Stripe, Inc.

Billing contact, email, payment method (tokenized) – USA

OpenAI, L.L.C.

LLM prompts and customer-submitted content – USA

Anthropic, PBC

LLM provider. – USA

OpenRouter, Inc.

LLM provider. Routes requests to model providers. – USA

Google LLC

(a) Vertex AI / Gemini for image and text generation; (b) Cloud Vision for image analysis; (c) Google Analytics via gtag on app.copley.com (production-only) – USA

Eleven Labs, Inc.

AI voice and speech generation; Text and content submitted for audio generation; voice/audio configuration metadata – USA

Black Forest Labs GmbH

Image prompts and reference images – Germany

Runware FZ-LLC

Image prompts – United Arab Emirates

Mendable AI, Inc. (Firecrawl)

URLs submitted by customer for competitive analysis – USA

n8n GmbH

Image-generation prompts and reference image URLs routed through Copley's n8n workspace – Germany / EU

NEXUSAI Services LLC (Kie.ai)

AI model inference invoked from Copley's n8n workflows; prompts and reference image/asset URLs – USA

Loudly GmbH

Music prompt text – Germany

ScrapeCreators

Instagram/YouTube handles and video IDs to scrape competitive content – USA

Klaviyo, Inc.

Copley user engagement events: tenant-owner email, tenant company name, event metadata (e.g., "Creative Report Created"). Distinct from the per-tenant Klaviyo integration (which is customer-controlled, not a subprocessor). – USA

HubSpot, Inc.

Marketing and analytics tracking on copley.com and app.copley.com. – USA

Automattic, Inc. (Gravatar)

SHA-256 hashes of authenticated user email addresses for avatar lookup – USA

FullStory, Inc.

Page navigation events, click events (excluding form input), authenticated user email, user ID, role, IP address, user-agent (loaded globally on app.copley.com) – USA

Meta Platforms, Inc.

Page-view events, IP, user-agent, cookies (Facebook Pixel, production-only, fires on app.copley.com including authenticated pages) – USA

LinkedIn Corporation

Page-view events, IP, user-agent, cookies (Insight Tag, production-only, fires on app.copley.com including authenticated pages) – USA

Wistia, Inc.

Video viewer behavior, IP, user-agent (player loaded globally on all app pages) – USA