Subprocessors

Shared tier

Customers on the shared processing tier have their audio processed by the providers below. Which ones apply depends on the configuration of your account; the defaults are marked.

• Deepgram (United States) — speech recognition, default provider. Receives audio streams. Audio is processed and not retained for training under our agreement; where a regional endpoint is configured for an account, processing happens in that region.
• OpenAI (United States, EU endpoint available) — machine translation, default provider, and speech synthesis when you switch dubbing on. Receives transcribed and translated text, never your audio; when dubbing is on it returns synthesised audio, which is played and discarded. Content submitted through the API is not used for training.
• Anthropic (United States) — machine translation, where selected for an account. Receives transcribed text, never audio.
• DeepL (Germany) — machine translation, where selected for an account. Receives transcribed text, never audio. We use the paid API only: the free tier permits the provider to use submitted texts, which would not be acceptable for user speech.

Local tier

Customers on the local processing tier have no AI subprocessors: speech recognition and translation run on infrastructure we operate. Only the infrastructure and support providers below apply.

All customers

• Hetzner / Hetzner Online GmbH (Germany, EU) — application hosting and databases.
• Paddle.com Market Ltd (United Kingdom) — merchant of record: sells the hour packs, takes payment, calculates tax and issues invoices. Receives your billing data as an independent controller for those purposes, and never receives audio or transcripts.
• Resend / Postmark (United States) — transactional email. Receives email addresses and the content of the messages we send you. Normally that content is account notices; if you switch on conversation recaps, it also includes the AI summary of each conversation that ends.
• Google Ireland Limited (Ireland; data may be transferred to Google LLC, United States, under the EU–US Data Privacy Framework) — website analytics (Google Analytics 4), only for visitors who allow analytics cookies, including a purchase event our server sends after Paddle confirms a payment. Receives pages visited, device and browser data and the IP address; never receives audio, transcripts or account content.

Models you connect yourself (MCP)

If you are a business customer and you connect your own AI model or agent to SubLive over the Model Context Protocol, that model receives conversation data: metadata, and the verbatim text of conversations when your model asks for it, including the speech of the people your staff talk to.

That provider is not on the list above because you choose it, not us. It is your subprocessor, under your agreement with it, and what it does with the data is your responsibility. The Data Processing Agreement sets out how this works and who answers for it.

Your browser (free mode and backup)

In the free mode, and for a while as a backup when one of our providers fails, speech recognition, translation and the spoken voice are done by features built into your Chrome browser. Chrome's speech recognition sends the tab's audio to Google, unless the language can be recognised on your device; translation runs on your device; a browser voice marked as online is generated on its maker's servers.

Google is not on the lists above because it does not process this data for us or under a contract with us: your browser sends it, under Google's own terms and privacy policy, and we receive no audio from it. We list it here so that you know where the audio goes. Company accounts use these browser features only if the company administrator has allowed it.

Changes

We give 30 days notice before adding a subprocessor. DPA customers may object; if we cannot resolve the objection, you may terminate the affected service without penalty.

Retention and regional settings above describe what our agreements and account configuration provide at the date of this page. Where a stricter arrangement (for example zero data retention) has been agreed for a specific account, it is stated in that account’s contract rather than here.

Subscribe to changes at [email protected].