Last updated 7 September 2026
Sub-processors
Every vendor that touches your data, what they do with it, and how you hear before the list changes.
A sub-processor is any third party that processes personal data on our behalf. Growthnix remains responsible to you for all of them. Publishing this list is not a legal requirement for every business — we publish it because a buyer evaluating an AI vendor is entitled to know which other companies end up holding their material, and because neither of the obvious alternatives to us discloses it.
1. Current sub-processors
Vendor names are being confirmed against the signed contracts before publication. The function, the data category, and the purpose below are accurate as of the date at the top of this page.
| Function | Data it processes | Purpose |
|---|---|---|
| Cloud hosting & storage | All platform data — account records, uploads, generated video | Runs the application and stores your files |
| Video generation | Product images, scripts, generation parameters | Renders the synthetic video itself |
| Speech synthesis | Script text, voice selection | Produces the presenter's voice track |
| Lip-sync and video post-processing | Generated video, voice track | Aligns the presenter's mouth to the voice track |
| Product page retrieval | Product URLs you submit, and the public page content behind them | Reads a product page so you do not have to re-type it |
| Realtime messaging | Session identifiers, generation status events | Pushes render progress to your browser |
| Affiliate attribution (only if you arrived via a partner link and accepted optional cookies) | Referral identifier, signup event | Credits the referring partner |
| Language model provider | Product descriptions, script drafts, prompts | Writes and varies scripts |
| Payment processing | Billing contact, card details (held by them, never by us) | Takes payment and manages subscriptions |
| Authentication | Email, name, session and login metadata | Signs you in and secures the account |
| Transactional email | Email address, message content | Sends receipts, alerts and password resets |
| Error monitoring | Diagnostic traces, IP address, scrubbed request context | Tells us when the product breaks |
| Product analytics | Pseudonymous usage events | Shows which features get used — refusable via cookie settings |
2. What we require of every one of them
- No training on your data. Where a vendor’s default terms would let them train models on data we send, we contract out of it before routing anything to them. This is the single non-negotiable term.
- A written data processing agreement imposing obligations at least as strict as those we owe you.
- Purpose limitation — they may use the data to perform their function and for nothing else.
- Breach notification to us without undue delay, so we can meet our own 72-hour obligation to regulators.
- Deletion on termination of the vendor relationship.
3. Where the data goes
Most of these vendors are US-based, so using the service involves transferring personal data out of the UK and EEA. Those transfers are covered by the UK International Data Transfer Agreement or the EU Standard Contractual Clauses, with a transfer risk assessment on file. See Privacy Policy section 5. Business customers who need a signed Data Processing Agreement can request one from hello@fireplaceugc.com.
4. Notice of changes
We will give 30 days’ notice before adding a new sub-processor or replacing an existing one, by updating this page and emailing account holders who have asked for notifications.
If you object to a new sub-processor on reasonable data-protection grounds, tell us within those 30 days. We will try to offer an alternative. If we cannot, you may cancel without penalty and receive a pro-rata refund of the unused period — you should not be forced to accept a vendor you have assessed and rejected.
To subscribe to change notices, or to request the current vendor names under NDA ahead of publication, write to hello@fireplaceugc.com.
Questions about this document? Write to hello@fireplaceugc.com. If something here contradicts another page in this set, tell us — a conflict between our own policies is our problem to fix, not yours to interpret.