Subprocessors and data processing
Last updated 6 October 2026
These are the third parties that process customer data when you use CastGenX. Each receives only what its step needs. See the privacy policy for what we store and your rights.
Third-party subprocessors
| Provider | Purpose | Data it receives | Region | Terms |
|---|---|---|---|---|
| Clerk | Sign-in and account identity. | Name, email address, avatar, sign-in method and session data. | US | DPA / privacy |
| Deepgram | AI voices (text to speech) and transcription. Requests opt out of Deepgram's model-improvement program. | Script text to be voiced; audio to be transcribed (recordings, takes and finished episodes). | US | DPA / privacy |
| NVIDIA Build | Script writing and editing suggestions (the default text model). | Episode briefs, script text, show settings and your Show Bible. | — | DPA / privacy |
| OpenAI | Text generation and cover art, when chosen or when you add your own key. Requests are sent with storage turned off. | Script text and briefs for text generation; image prompts for cover art. | US | DPA / privacy |
| ElevenLabs | Premium voices, AI music and AI sound effects, only if you use them. | Script text to be voiced; prompts describing music or sound effects. | — | DPA / privacy |
| TypeSafe | AI quality and safety checks on script and metadata text (no audio is sent). | Script text, episode titles, descriptions and captions. | — | DPA / privacy |
| Stripe | Payments, subscriptions and invoices. | Billing name, email, billing address and payment details (we never see your full card number). | US | DPA / privacy |
| Resend | Account and production emails you've asked for. | Your email address and the content of the email. | US | DPA / privacy |
| Sentry | Error reports, only if you choose “Allow all” in the cookie banner. | Technical details of the error: browser, page, and a stack trace. No audio or scripts. | US | DPA / privacy |
| Amplitude | Product analytics and Session Replay in the browser, only if you choose “Allow all” in the cookie banner. On our server it also records usage metrics for AI text-model calls (model, token counts, cost, speed and errors) in metadata-only mode, without any prompt, script or reply text. | Browser: pages viewed, clicks and other interactions, device and browser details, approximate location from IP, and a replay of the session with typed text masked. Server: your account ID, the AI feature used and its metrics. | US | DPA / privacy |
| Google (YouTube) | Uploading episodes to YouTube, only if you connect your YouTube channel. Uses the YouTube API Services. | The episode video, title, description and tags you publish; an OAuth token for your channel (stored encrypted, revoked when you disconnect). | US | DPA / privacy |
| OP3 (Open Podcast Prefix Project) | Open download counting for a show, only if you turn it on in the show's analytics settings. | Each podcast-app download request for that show's episodes passes through op3.dev, which sees the listener's IP address and app (user agent). We receive only aggregated counts by day, country and device. | — | DPA / privacy |
| Podcast Index and Podping | Tells podcast apps that a public feed has a new episode. Private feeds are never announced. | The public feed URL only. | — | — |
| AppSumo | Lifetime-deal licence redemption. | Your licence key and the email on the AppSumo order. Nothing you create in CastGenX. | US | DPA / privacy |
A dash under Region means we have not yet confirmed where that provider processes data. When you connect your own API key for a provider, those requests run under your own agreement with it.
Our own infrastructure
The app, the database and file storage (self-hosted PocketBase) run on our own virtual private server (VPS), operated by us. Not a third-party processor.
Data processing agreement
Our data processing addendum applies automatically to every customer. If you need a countersigned copy, request one at support@castgenx.com.
Changes to this list
We notify customers of a new subprocessor by updating this page at least 14 days before it starts processing customer data. If you object to a new subprocessor, contact us before that date.