MONSORA SUBPROCESSORS AND SERVICE PROVIDERS LIST
This list identifies every third party that processes personal data on our behalf in connection with Monsora. It is referred to in the Monsora Privacy Policy and forms part of the information we give you under that Policy. Terms defined in the Privacy Policy and the Terms of Service have the same meaning here.
Monsora stores the primary copy of User Content in cloud infrastructure. Cloudflare, Inc. therefore stores User Content for every user; account data is processed by the providers described below. Google processes additional content only while the AI Features are enabled for the user.
1. WHAT THIS LIST IS
1.1. Why we publish it. We publish this list so that you can see who processes personal data on our behalf, what each provider does, where it does it, and on what legal footing. Publishing it separately from the Privacy Policy is deliberate. It means we can add or replace a provider by updating this list and giving notice under Section 15.2, rather than by amending the Privacy Policy, and it means the current position is always visible in one place.
1.2. What a subprocessor is. A subprocessor is a company that processes personal data on our instructions, for our purposes, under a contract with us. A subprocessor may not use your personal data for its own purposes, may not disclose it except as we instruct or the law requires, and must return or delete it when we tell it to.
1.3. What is not on this list. Companies that are not processing personal data for us are not subprocessors and are not listed as such. That includes the sign-in providers described in Section 12, and it includes any external artificial intelligence platform you choose to use before you bring material into Monsora, which is a service you use directly under its own terms and over which we have no control.
1.4. Where this list is published. The current version is published at https://monsora.ai/legal/, and earlier versions are available on request.
2. HOW TO READ EACH ENTRY
2.1. What each entry tells you. For each provider we state the legal entity we contract with, what it does for us, which categories of personal data it processes, where the processing takes place, and the mechanism we rely on if the processing involves a transfer out of the European Economic Area, the United Kingdom or Switzerland.
2.2. Conditional entries. Core cloud storage with Cloudflare applies to every account. The AI Features and product analytics have separate settings and, where required, separate consent; they are enabled by default only where separate consent is not required. The local-cache setting does not change supplier processing. AI processing sends material to the model provider only while the AI Features are enabled for the user.
2.3. Categories rather than field lists. We describe categories of personal data rather than listing every field, and the Privacy Policy sets out the field level detail. Where the two differ, the Privacy Policy is the fuller statement.
3. CLOUDFLARE, INC.
3.1. When this entry applies. This entry applies to every user. Cloudflare, Inc. stores the primary copy of User Content in the cloud library for every user.
3.2. Legal entity and group. Cloudflare, Inc., incorporated in the United States.
3.3. What it does for us. It provides our cloud object storage.
3.4. What it processes. User Content, including thumbnails, previews and metadata, for every user.
3.5. Where it processes. The United States. Our storage is deployed in the United States West region.
3.6. Transfer mechanism. We contract with this provider on its standard data processing terms, which include the data protection commitments required of a processor and the transfer terms the provider makes available. Where personal data is stored in or accessed from a country outside the European Economic Area, the United Kingdom or Switzerland, we rely on those terms together with the safeguards described in Section 11 of the Privacy Policy.
3.7. Its own subprocessors. Cloudflare publishes its own subprocessor information and may use its own subprocessors on terms at least as protective as those we have agreed with it, as Section 16 explains.
4. AMAZON WEB SERVICES, INC.
4.1. When this entry applies. This entry applies to every user. Amazon Web Services provides the infrastructure on which the service runs, including our production database.
4.2. Legal entity and group. Amazon Web Services, Inc., incorporated in the United States, or the Amazon Web Services group company that contracts with us for the region in which our account is held. We will update this entry if that entity changes.
4.3. What it does for us. It provides our computing, database, caching, queueing, content-delivery and backup infrastructure, and the infrastructure on which our product analytics pipeline runs. Our analytics are processed on infrastructure we control rather than through any third party analytics product, and only while product analytics are enabled for the user.
4.4. What it processes. Account data, including your email address and account identifiers. Server access logs. Operational records. User Content is stored with Cloudflare; Amazon Web Services processes User Content only as necessary to operate the Services. Product analytics events only while product analytics are enabled for the user.
4.5. Where it processes. The United States. Our production database and run-time infrastructure are in the United States West (Oregon) region.
4.6. Transfer mechanism. We contract with this provider on its standard data processing terms, which include the data protection commitments required of a processor and the transfer terms the provider makes available. Where personal data is stored in or accessed from a country outside the European Economic Area, the United Kingdom or Switzerland, we rely on those terms together with the safeguards described in Section 11 of the Privacy Policy.
4.7. Its own subprocessors. Amazon publishes its own subprocessor information and may use its own subprocessors on terms at least as protective as those we have agreed with it, as Section 16 explains.
5. GOOGLE LLC - GEMINI API
5.1. When this entry applies. This entry applies only while the AI Features are enabled for you. It applies separately from core cloud storage and separately from product analytics. If the AI Features are not enabled for you, no User Content is sent to this provider for those features. If you later withdraw consent or change your choice, Monsora stops new AI transmissions, deletes its semantic search index and any image descriptions, and limits search to local substring matching; Google's limited safety logs may remain until the retention period below expires.
5.2. Legal entity and group. Google LLC, a company incorporated in the United States. We will update this entry if the contracting entity changes.
5.3. What it does for us. Google provides the Gemini service used to build and run semantic search and, where you enable image descriptions, to generate text descriptions of your images.
5.4. What it processes. Images added to Monsora and images extracted locally from the videos you import, but not the video files themselves; text information associated with your material; and text or image search queries. Google uses this content to build and run semantic search and, where you enable image descriptions, to generate text descriptions of your images. User Content stored in the core cloud library is not sent to Google merely because it is stored there.
5.5. Where it processes. Google processes and may transiently store or cache data in the countries in which Google or its agents maintain facilities.
5.6. Safety screening and retention. Google applies automated screening and may use authorised human review to detect and prevent violations of its Prohibited Use Policy. Under Google's current published terms, prompts, contextual information and outputs logged for abuse monitoring are retained for up to fifty-five (55) days for safety, policy enforcement and required legal or regulatory disclosures. This limited retention may continue after a response is returned or after consent is withdrawn. We will update this entry if the applicable service terms or an approved zero-data-retention configuration changes that period or scope.
5.7. No use for model training. We use a billing-enabled paid service under which Google does not use our prompts or responses to improve its products. Data logged for abuse monitoring is not used to train or fine-tune general-purpose artificial intelligence or machine learning models. We do not use an unpaid Gemini tier for the AI Features.
5.8. Transfer mechanism. Google processes personal data under the applicable Data Processing Addendum for Products Where Google is a Data Processor. Where personal data protected in the European Economic Area, the United Kingdom or Switzerland is transferred to a country that is not recognised as adequate, we rely on the applicable standard contractual clauses and supplementary transfer terms described in Section 11 of the Privacy Policy. We carry out and document the required transfer assessment before production use.
5.9. Its own subprocessors. Google may use its own subprocessors subject to the applicable data processing terms. We review the current list and applicable change-notice mechanism and make information about relevant onward providers available on request.
6. GOOGLE LLC - EMAIL SERVICE (GOOGLE WORKSPACE)
6.1. When this entry applies. This entry applies to every user. We use Google Workspace to send service messages, such as account, security, authentication and test-phase notices, to the email address registered to your account, and to receive and handle correspondence sent to us.
6.2. What it processes. Your email address and the content of service messages and correspondence.
6.3. Where it processes. The United States.
6.4. Transfer mechanism. Google processes personal data under the applicable Data Processing Addendum for Products Where Google is a Data Processor. Where personal data protected in the European Economic Area, the United Kingdom or Switzerland is transferred to a country that is not recognised as adequate, we rely on the applicable standard contractual clauses and supplementary transfer terms described in Section 11 of the Privacy Policy. We carry out and document the required transfer assessment before production use.
6.5. Its own subprocessors. Google may use its own subprocessors subject to the applicable data processing terms. We review the current list and applicable change-notice mechanism and make information about relevant onward providers available on request.
7. SUPABASE PTE. LTD. - AUTHENTICATION
7.1. When this entry applies. This entry applies to every user who creates an account or signs in. Supabase provides the authentication service we use to create, sign in to and secure your account.
7.2. Legal entity and group. Supabase Pte. Ltd., a company incorporated in Singapore.
7.3. What it processes. Account data, including your email address, authentication identifiers and session information.
7.4. Where it processes. The United States. Our authentication service is hosted in the United States West region.
7.5. Transfer mechanism. We contract with this provider on its standard data processing terms, which include the data protection commitments required of a processor and the transfer terms the provider makes available. Where personal data is stored in or accessed from a country outside the European Economic Area, the United Kingdom or Switzerland, we rely on those terms together with the safeguards described in Section 11 of the Privacy Policy.
7.6. Its own subprocessors. Supabase publishes its own subprocessor information and may use its own subprocessors on terms at least as protective as those we have agreed with it, as Section 16 explains.
8. GRAFANA LABS, INC. - OPERATIONAL MONITORING
8.1. When this entry applies. This entry applies to every user. We use Grafana Cloud, operated by Grafana Labs, Inc., to monitor the health, performance and reliability of our services.
8.2. What it processes. Operational monitoring data: technical metrics and traces about how our services perform. This data does not include your name, email address, account identifier, IP address, or the content of your requests or your material. Web-side telemetry is sent only where the corresponding setting is enabled for the user and, where separate consent is required, given, and it stops when the setting is disabled or consent is withdrawn.
8.3. Where it processes. The United States. Processing takes place in the United States West region.
8.4. Transfer mechanism. We contract with this provider on its standard data processing terms, which include the data protection commitments required of a processor and the transfer terms the provider makes available. Where personal data is stored in or accessed from a country outside the European Economic Area, the United Kingdom or Switzerland, we rely on those terms together with the safeguards described in Section 11 of the Privacy Policy.
8.5. Its own subprocessors. Grafana Labs publishes its own subprocessor information and may use its own subprocessors on terms at least as protective as those we have agreed with it, as Section 16 explains.
9. JINA AI GMBH (PART OF ELASTIC N.V.) - SEARCH RE-RANKING
9.1. When this entry applies. This entry applies to every user who searches. We use a search re-ranking service to improve the ordering of search results.
9.2. What it processes. Your search query text and, for a limited number of result candidates, small preview images derived from those candidates. Original files and full-resolution images are not sent. It uses this content only to re-rank results for that search and returns the ranking to us.
9.3. Where it processes. The provider does not publicly disclose its processing regions; processing is governed by the Elastic Customer DPA.
9.4. Transfer mechanism. We use the service under the Elastic customer data processing terms (the Elastic Customer DPA), incorporated by reference into the provider's terms, together with the safeguards those terms make available.
9.5. Its own subprocessors. The provider publishes its subprocessor information within Elastic's framework and may use its own subprocessors on terms at least as protective as those we have agreed with it, as Section 16 explains.
10. VERCEL INC. - WEB HOSTING AND WEB ANALYTICS
10.1. When this entry applies. Vercel hosts our web application. The analytics part of this entry applies only while product analytics is enabled for you.
10.2. What it does for us. Vercel operates the hosting and content delivery for our web application and provides aggregated page-view analytics for it.
10.3. What it processes. As host: requests, technical logs and related connection data needed to serve the application to you. As analytics provider: anonymised page-view events (pages viewed, approximate timing and technical properties). It does not receive your file names, file paths, file contents, prompts, thumbnails or free-text fields, and analytics events are not linked to your account identifier.
10.4. Where it processes. The United States. Our web application is hosted in Vercel's us-east-1 (United States East) region.
10.5. Retention. Aggregated page-view statistics under Vercel's standard web-analytics terms. The measurement uses no cookies, cannot follow a visitor across days or sites, and visitor sessions are discarded after 24 hours. It is sent only where product analytics are enabled for the user.
10.6. No use for our content. Vercel does not use User Content for its own purposes, and aggregated analytics are not used to train models on your content.
11. TIMESTAMPING PROVIDER FOR EVIDENCE PACKAGES
11.1. When this entry applies. This entry applies only if such services are provided and you use the Evidence Packages and timestamping feature described in the Terms of Service. If such services are not provided or you never use that feature, no material of yours reaches this provider.
11.2. Feature under development. The Evidence Packages and timestamping feature is still under development and is not yet generally available. The details of this entry, including the identity of the timestamping provider, the data processed and the processing location, are provisional and may change before or as the feature is released. We will update this list to reflect the final position before the feature is made available to users.
11.3. Legal entity and group. Trusted timestamps are obtained from DigiCert, Inc., a company incorporated in the United States, using its RFC 3161 compliant timestamping service.
11.4. What it does for us. It issues a cryptographic timestamp token that records the time at which a file existed, so that you can later demonstrate that the file existed in a particular form at a particular time.
11.5. What it processes. Only a cryptographic hash of the relevant data is submitted, together with the technical information required to process the timestamp request. We do not send the file, image or any of its content. DigiCert may also process standard network-level information associated with the request, such as the requesting IP address and related technical logs.
11.6. Where it processes. The United States, with DigiCert, Inc. based in Lehi, Utah.
11.7. Transfer mechanism. Where the submission of a hash involves any transfer of personal data out of the European Economic Area, the United Kingdom or Switzerland, we rely on the provider's standard terms together with the safeguards described in Section 11 of the Privacy Policy. Where no personal data is submitted, no transfer of personal data arises.
12. SIGN-IN PROVIDERS, WHICH ARE NOT SUBPROCESSORS
12.1. Why they are here. If you choose to sign in using Google or Discord, those companies are involved in your use of Monsora, but they are not processing personal data on our behalf. They act for their own purposes under their own terms, and they are listed here for completeness rather than as subprocessors.
12.2. What happens when you use them. When you sign in with one of them, that company authenticates you and passes a limited set of information to us, which the Privacy Policy identifies. It also learns that you have signed in to Monsora. We do not receive your password and we do not act on their behalf.
12.3. If you would rather not involve them. You can create an account with an email address instead. Nothing in Monsora requires you to use a third party sign-in provider.
13. SERVICE PROVIDERS WE DO NOT USE
13.1. Why this Section exists. A list of providers tells you who we use. It is at least as useful to tell you who we do not, because the categories below are where most consumer software quietly leaks personal data. Each statement is a statement of fact about Version 1.0 and is capable of being checked.
13.2. No third party analytics or crash reporting. Monsora contains no third party analytics or crash reporting software development kit, other than the page-view measurement provided by our web hosting provider. Product analytics run on infrastructure we control.
13.3. No advertising or tracking. We use no advertising network, no advertising identifier, no attribution or measurement provider, and no cross site or cross app tracking technology.
13.4. No data brokers or enrichment. We buy no personal data, we sell none, and we use no data broker, enrichment provider or audience matching service.
13.5. No payment processor. Version 1.0 involves no payment, so no payment processor or card network receives anything from us. If a paid version is introduced, a payment provider will be added to this list before it goes live.
13.6. No customer support or marketing platform. Support correspondence is handled directly by us, and no third party helpdesk, ticketing, live chat, customer relationship management or email marketing platform receives your personal data.
14. ACCESS BY OUR OWN PERSONNEL
14.1. Why this is in the list. Access by our own people is not subprocessing, but a list of who can reach your data is incomplete without it, and it is one of the first questions a careful reader asks.
14.2. Who can access what. Access to content held in the Cloud Services is limited to the personnel who need it in order to operate, support and secure the service. Access is granted by role rather than held as a standing permission by named individuals, requires multi factor authentication, and is recorded. Privacy requests are handled by our Privacy & Safety Officer, and access to the contents of a request is limited to that person. The Privacy Policy sets out the detail.
14.3. Where that access happens from. A limited number of authorised engineering personnel located in mainland China can access production systems, solely for incident response and technical support. That access is granted by role, is time limited where practicable, requires multi factor authentication and managerial approval, is logged, and is reviewed periodically. Bulk download of user content is not permitted. Because this is access to personal data from outside the European Economic Area, the United Kingdom and Switzerland, we treat it as a transfer, and the safeguards described in Section 11 of the Privacy Policy apply to it.
15. HOW WE CHANGE THIS LIST
15.1. We may add, remove or replace a provider. Operating a service means changing providers from time to time. When we do, we update this list.
15.2. Notice before a new provider starts processing. We will give you at least thirty days' notice, by email or in the application, before a new provider begins processing your personal data, except where Section 15.5 applies.
15.3. If you object. If you object to a new provider, you may disable the separately controlled AI Features or product analytics that it supports, export your content, or close your account. Where the provider supports a feature you do not use, the change does not affect you. Core cloud storage remains part of the Services.
15.4. Change record. Each version of this list records the date of the last update and what changed. We keep earlier versions and will provide them on request.
15.5. Changes we must make immediately. Where a provider has to be changed at short notice for security, legal or continuity reasons, we may make the change first and notify you as soon as we can, and we will explain why the notice period was not followed.
16. ONWARD SUBPROCESSORS AND QUESTIONS
16.1. Onward subprocessors. Our providers may use their own subprocessors, and where they do they must impose obligations at least as protective as those we have agreed with them. Each of the providers listed above publishes its own subprocessor information, and we will point you to it on request.
16.2. Asking for transfer documentation. If you want to know which safeguards apply to a particular transfer, or to see a copy of the transfer terms we rely on, write to hi@monsora.ai and we will provide them with commercially sensitive terms redacted.
16.3. Questions and complaints. For any question about this list, write to hi@monsora.ai. The rights described in the Privacy Policy, including the right to complain to a supervisory authority, apply to processing carried out by every provider named here.
16.4. Who publishes this list. This list is published by Shanghai Shichu Culture Technology Co., Ltd. with the registered address at No. 25-1 Hongcao Road, Xuhui District, Shanghai, China.