This page lists the third parties Cutvey LLC uses to run its products, and that may process personal data on our behalf. It is part of the Cutvey Privacy Policy and is incorporated into our Data Processing Addendum.
Every party in the table of current subprocessors below processes data for us under written terms (their data processing terms, our agreement, or both) that limit them to providing their service to us, and that require confidentiality and appropriate security. The weather service our servers ask for a forecast is different: we pay for it and use it under its published terms, but it publishes no data processing agreement, so it is not in that table, and it has a section of its own below that says exactly what it is sent. None of them is an advertising network or a data broker, and none may use the data for advertising. One of them, our email provider, holds correspondence you send us rather than data from a workspace. Two of them also act on their own account for part of what they do, and we say which and why below, rather than implying a control we do not have.
| Provider | Purpose | Data it may process | Location | First listed |
|---|---|---|---|---|
| DigitalOcean, LLC | Application hosting and compute for the Service | All data held in the Service: account data, workspace content, logs | United States (New York) | August 21, 2026 |
| netcup GmbH | Media processing for the Service: streaming versions, posters, thumbnails and previews, including watermarked previews, of the videos and photos you upload. The originals and every result are stored with Cloudflare, below, and nothing is played or served from netcup's server | Copies of uploaded videos and photos, one file at a time, which may show or identify people and may carry names in file names and watermark text. Each copy is held only while it is being processed, then deleted. No account data, no database access and no storage credentials | United States (Manassas, Virginia) | September 28, 2026 |
| Cloudflare, Inc. | File storage (R2), database backups, CDN and DNS, bot protection, routing of email sent to your workspace's Cutvey address, and hosting for the marketing and product websites. Cloudflare's network also stands in front of the Service: it receives the traffic to the web application and to studios' custom domains, protects it against attacks and abuse, and passes it to our servers, and it issues and renews the TLS certificate a visitor's browser sees for the application and for a custom domain | Uploaded files and media, database backups, IP address and request metadata, form submissions passing bot checks, and, for inbound email, the sender, subject and body of a message sent to your workspace's Cutvey address, which the routing provider sees before we do. For traffic to the web application and to custom domains, Cloudflare also processes the content of each request and response while it passes through its network, which is whatever is being sent or viewed in the Service at that moment, together with the IP address and connection details of the person's device. The connection is decrypted on Cloudflare's network so that it can be inspected and protected, and encrypted again on the way to our servers. Cloudflare processes that content in transit, to deliver and protect it; it may hold a temporary cached copy of static application files and of files a workspace has made public, and it keeps security and traffic records about requests | Stored data (object storage and backups) is held in the United States, encrypted at rest by Cloudflare with keys Cloudflare manages. CDN and DNS traffic, and traffic to the web application and to custom domains, is handled on a global edge, so a request may be received and processed at a location near you, which may be outside the United States, before it is passed to our servers in the United States, under Cloudflare's own data processing addendum and transfer clauses | August 21, 2026. Role extended October 5, 2026, to the network in front of the Service |
| Stripe, Inc. | Subscription billing for Cutvey plans and App licenses, and Stripe Connect so a studio's clients pay the studio directly | Name, email, billing address, payment method (held by Stripe, never by us), subscription and transaction records | United States, with regional processing by Stripe | August 21, 2026 |
| Resend, Inc. | Transactional and product email delivery | Recipient email address, sender and message content, delivery, bounce, open and click events | United States | August 21, 2026 |
| ActiveCampaign, LLC (Postmark) | Fallback transactional email delivery, used only when the primary provider is unavailable | Same as above | United States | August 21, 2026 |
| Google LLC (Google Workspace) | Business email and calendar for contact@cutvey.com, which is how we receive and answer support, privacy, legal and abuse correspondence | The content of email you send us and our replies, your email address, and any attachment you send | United States, with Google's global infrastructure | August 21, 2026 |
| Anthropic, PBC | AI assistant features in the Service | The text or workspace data you point an AI feature at, and the generated output. Under Anthropic's commercial API terms, inputs and outputs are not used to train models | United States | August 21, 2026 |
| OpenAI, L.L.C. | Standby AI provider for AI assistant features in the Service, used only when our primary AI provider is unavailable | The text or workspace data you point an AI feature at, and the generated output. Under OpenAI's commercial API terms, inputs and outputs are not used to train models | United States | September 8, 2026 |
| Apple Inc. | Push notification delivery (APNs) for the native apps and the companion app | Device push tokens | United States and Apple's global infrastructure | August 21, 2026 |
| KEPTAGO LTD (Geoapify) | Place search and routing for the Service: finds the coordinates of a place you type, so that a call sheet can show a forecast and the nearest hospital, finds that hospital, and works out the driving distance of a trip in Books mileage | The address of a shoot location as typed, or its name if it has no address, or the workspace's own business address if the day has no location, and up to two shorter forms of the same text (with any suite, unit, apartment or floor number taken out, and without its first part or its first two parts); for Books mileage, the two places typed for a trip, or the saved address of a place saved under that name. For the nearest hospital, the latitude and longitude found for the place. For a driving distance, two pairs of latitude and longitude. Every request is made by our servers, never by your browser, so it carries no IP address, cookie or device detail of yours, and nothing we add that identifies you or your studio: no name, no email address, no account and no workspace identifier. The place text is sent as it was typed, so the name of a venue, or of a person if one was typed there, goes with it, and a shoot at a private home sends that home's address | European Union. We use Geoapify's European Union endpoint, which it commits to process only within the European Union. The company is established in Cyprus | October 9, 2026 |
| Sentry (Functional Software, Inc.) | Crash reporting for the native apps, and server error reporting for the Service | Technical diagnostics: app, operating system and release version, device or server context, the operation that failed, memory figures and the stack trace. Reports are designed and filtered so that they do not carry customer content, and we remove account names, volume names and access tokens on the paths we control before a report is sent. Where personal data nevertheless appears in the text of an error, we treat that report as customer data | United States | August 21, 2026 |
| GitHub, Inc. (Microsoft) | Source code hosting and continuous integration | Source code and build logs. No customer data and no production personal data | United States | August 21, 2026 |
We name two AI providers because one is a standby for the other, in the same way our email list names a fallback. Only one of them handles any given request, and which one it is does not change what may be sent or how it may be used.
Where we change the provider that routes inbound email to us, that is a change to this list under the process on this page.
Where a provider above that is established outside the EEA, the UK and Switzerland receives personal data protected by the law of any of them, we have Standard Contractual Clauses in place with it, with the UK Addendum where relevant.
netcup GmbH is established in Germany and is directly subject to the GDPR. It processes for us on a server in the United States under its data processing agreement under Article 28 of the GDPR, which we concluded with it on September 28, 2026. Its group companies in Germany and Austria, which it names as its own subprocessors, may access that server for support and infrastructure work. They are Anexia Holding GmbH and Anexia Cloud Solutions GmbH, both of Klagenfurt, Austria, and Anexia Cloud Solutions GmbH of Karlsruhe, Germany.
KEPTAGO LTD, which operates Geoapify, is established in Cyprus and is directly subject to the GDPR. It processes for us in the European Union under its data processing agreement under Article 28 of the GDPR. For the endpoint we use it names two subprocessors of its own: BunnyCDN in Slovenia, and Hetzner in Germany and Finland.
Contact details. Each provider publishes a privacy contact in its own privacy policy. If you need the current contact details for any provider on this list, for a data subject request, for Annex III of the Standard Contractual Clauses, or for your own records, email contact@cutvey.com and we will send them to you. We keep them rather than reprint them here, so that this page cannot go stale about somebody else's address.
The weather forecast, sunrise and sunset shown on a call sheet and a shoot day come from Open-Meteo, a weather service operated by OpenMeteo GmbH of Bürglen, Switzerland. We pay for its commercial plan and use it under the terms it publishes for that plan. It is not in the table above because it differs from it in one important way: it publishes no data processing agreement, and we have not signed one with it. The statements on this page and in our Privacy Policy about data processing terms, and about Standard Contractual Clauses, do not apply to it.
What limits it is what we send. Every request is made by our servers, never by your browser, so it receives no IP address, cookie or device detail of yours, and no request carries anything that identifies you or your studio: no name, no email address, no account, no workspace identifier, and no address or place name. A request carries the key of our own account with it, which says that the request comes from Cutvey.
| Service | Operated by | What it does for us | What our servers send it | When |
|---|---|---|---|---|
| Open-Meteo forecast (customer-api.open-meteo.com) | OpenMeteo GmbH, Switzerland | The weather forecast, sunrise and sunset shown on a call sheet and a shoot day | The latitude and longitude found for the place, and the date of the shoot | When a forecast for that day is first needed, and again when it is refreshed |
Its published terms say that it keeps a log of the requests made to it, including the address of the server that asked, which is ours, and the request itself, for 90 days. Where a call sheet shows its forecast, the call sheet credits it.
Open-Meteo was listed in the table of current subprocessors until October 9, 2026. It is described here instead because we have no data processing agreement with it, and because that entry gave the wrong company and country.
Two of the companies above also act on their own account, not only on ours, and it would be misleading to present them purely as our subprocessors.
Cutvey LLC currently has no affiliates or group companies that process personal data. If that changes, they will be listed here.
For clarity, these process data, but not on our behalf:
We keep this list current, and we do not add a subprocessor quietly.
We describe each provider by the job it does. Replacing a provider with another that does the same job, in the same country, under the same kind of terms, follows the notice process below like any other change.
Questions: contact@cutvey.com.
