At a glance (non-binding summary)

This page lists every third party that can access personal data when you use Audexum. Meta is not on it because it is not our sub-processor: if you accept advertising cookies, Meta receives data as a joint controller, described in /privacy section 9. The most important thing to know is where your content goes:

Most speech, transcription and chat processing runs on our own hardware in Bulgaria. Some of it does not: the V4 voice tier always runs on a hosted model, and during scheduled windows when our own GPUs are busy, other requests — including voice-cloning requests, which carry your enrolled reference clip — are processed by hosted models reached through OpenRouter (United States). Section 4 says exactly which.

Image and video generation is off until you turn it on. If you do, your prompts and any image you upload go to fal (United States), and through fal to the developer of the model you pick; for Motion Cinema they go instead to OpenRouter (United States) and through it to BytePlus, ByteDance’s cloud service, which processes them in Asia or the US. Section 2A says exactly which.

The one thing we want you to read carefully is section 3. Our TLS connections terminate at Cloudflare’s edge, which means Cloudflare is technically able to see the content of requests as they pass through. We would rather tell you that than describe Cloudflare as “DNS and routing”.

The numbered sections below are the binding ones.

1. What this page is

Audexum (“we”, “us”) operates audexum.com from Bulgaria. A sub-processor is a third party we engage that may process personal data on our behalf in the course of providing the Service. This page is the current list referred to in our Data Processing Addendum and in our Privacy Policy.

It applies whether you use the web app, the Android app, the Windows desktop app, the REST API, the compatibility API, or the embeddable widget. If you embed our widget on your own site, the same list applies to the visitors you send through it.

Each provider below operates under the data-processing terms it publishes for its own service. We have not separately negotiated terms with any of them. We tell you that because it is true, and because a business buyer should price it in rather than discover it during due diligence.

2. Current sub-processors

Current sub-processorsDetails

Legal entity	Service provided	Data it receives	Processing location	Transfer mechanism
Stripe Payments Europe, Ltd.	Payments, checkout, invoicing, anti-fraud	Email address, Stripe customer ID, purchase amount and currency, billing country, and the card and device data you enter on Stripe’s own checkout pages. We never see card numbers.	Ireland (EEA)	None needed for the EEA entity. Stripe acts as an independent controller for its own fraud-prevention purposes, and for that processing Stripe’s own privacy notice governs, not ours.
Cloudflare, Inc.	DNS, the tunnel that carries all traffic to our servers, TLS termination, DDoS protection, Turnstile anti-bot checks, and inbound Email Routing	All HTTP traffic to and from the Service, in the clear: IP address, user-agent, request paths and timestamps, and request and response bodies — which includes submitted text, uploaded audio or video, and generated audio. Turnstile additionally receives your IP address and browser signals. Email Routing receives every inbound email sent to an @audexum.com address.	Global edge network; US parent company	The EU Standard Contractual Clauses incorporated into Cloudflare’s published data-processing terms. We have not published a transfer impact assessment.
Resend, Inc.	Outbound email: transactional (verification, password reset, receipts, security and policy notices) and, where you agreed to it, onboarding and marketing email	Recipient email address, the subject and body of the message, and delivery metadata such as bounces	United States	The EU Standard Contractual Clauses incorporated into Resend’s published data-processing terms. We have not published a transfer impact assessment.
Amazon Web Services, Inc. (Amazon SES)	Onward sub-processor: the mail infrastructure Resend sends through	The same outbound email content and recipient addresses that Resend receives	United States	Engaged by Resend, under Resend’s sub-processor terms and the Standard Contractual Clauses in AWS’s published data-processing terms. We have no direct contract with AWS.
GitHub, Inc.	“Sign in with GitHub” — only if you choose it	Your GitHub account identifier, email address, and the fact and time of a sign-in	United States	The EU Standard Contractual Clauses in GitHub’s published data-protection terms. Not used at all unless you choose GitHub sign-in.
OpenRouter, Inc.	Routing to hosted AI models: the V4 voice tier always; text-to-speech, voice cloning, speech-to-text, the chat assistant and text clean-up during scheduled windows when our own GPUs are unavailable; the automated safety check on image and video prompts and results, only for accounts that turn those tools on (section 2A); and the Motion Cinema video engine for those accounts (section 2A). The Motion Pro engine is not yet active	The content of those requests: text to be spoken, audio to be transcribed, chat messages, for voice cloning your enrolled reference clip, and for the media safety check the prompt, each generated image and three frames of each video; for Motion Cinema also the generation settings and any image you upload. Not your name, email or payment details.	United States. OpenRouter passes each request to the inference provider hosting the selected model (currently xAI, Google, Fish Audio and other providers OpenRouter lists for that model), which may process it in the United States. For Motion Cinema, BytePlus (section 2A), outside the US as well.	OpenRouter’s data processing agreement, part of its terms, with the EU Standard Contractual Clauses (module 2) and us as data exporter. OpenRouter does not store request content by default; the model providers it routes to set their own retention and use rules. We have not negotiated separate terms.
Google Ireland Limited / Google LLC	“Sign in with Google”. Google’s sign-in script loads on the sign-in and sign-up pages only. Also the mailbox that inbound email to our published addresses is delivered to	Your Google account identifier, primary email address, and the fact and time of a sign-in to Audexum. When the sign-in pages load Google’s script, Google receives your IP address and browser details. Inbound email: whatever you write to us, with your address	Ireland (EEA), with US onward processing by Google LLC	The EU Standard Contractual Clauses incorporated into Google’s published terms. Not used at all if you sign in with an email address and password.

Separately from the list above, we may disclose personal data to professional advisers under a duty of confidence, and to competent authorities where the law requires it. Those are recipients, not sub-processors.

2A. Image and video generation (feature sub-processors)

These sub-processors are used only if you turn on image and video generation, and are named on the screen where you turn it on. An account that never turns it on sends them nothing. Under section 5 they are feature sub-processors: turning the tools on is your authorisation. Which product runs on which model is at /ai-disclosure.

Image and video generation sub-processorsDetails

Legal entity	Service provided	Data it receives	Processing location	Transfer mechanism
fal (Features & Labels, Inc.)	Runs the Motion, Motion HD, Image and Image Pro engines, called from our servers	Your prompt, your generation settings, and the image you upload if you use one (with location and camera metadata removed). It returns the generated file, which we download and serve from audexum.com. Not your name, email or payment details.	United States	The EU Standard Contractual Clauses incorporated into fal’s published data processing addendum. That addendum lets fal keep request data for as long as our contract runs unless agreed otherwise, and use de-identified data to improve its service. We have not negotiated separate terms or published a transfer impact assessment.
Black Forest Labs	Developer of the FLUX.2 model behind Image, reached only through fal	The same request data as fal, only where fal passes the request to the developer’s own service rather than running the model itself	fal does not state this per model; fal’s own sub-processor list is at trust.fal.ai/subprocessors	Engaged by fal, under fal’s data processing addendum; we have no direct contract
Google LLC	Developer of the Nano Banana 2 model behind Image Pro, reached only through fal	The same request data as fal, where fal passes the request to Google’s API	United States	Engaged by fal, under fal’s data processing addendum; we have no direct contract
MiniMax	Developer of the H3 models behind Motion and Motion HD, reached only through fal	The same request data as fal, where fal passes the request to MiniMax’s own service	Where fal runs the model, the United States. Where fal passes the request to MiniMax, it may be processed outside the US, including in Singapore or China. We are confirming this with fal and will update this row	Engaged by fal, under fal’s data processing addendum; we have no direct contract
OpenRouter, Inc., and Google LLC as the host of the model it routes to	The automated safety check on every image and video request: the prompt before generation, and the result after it. The check runs on a Google model (Gemini Flash-Lite) that OpenRouter passes the request to	Your prompt, each generated image, and three frames taken from each generated video. Not your name, email or payment details	United States	As in OpenRouter’s row in section 2; Google is engaged by OpenRouter under its published terms
OpenRouter, Inc., and BytePlus Pte. Ltd. (ByteDance group), through OpenRouter	Runs the Motion Cinema engine (Seedance 2.5, a BytePlus video model). OpenRouter passes the request to BytePlus, ByteDance’s cloud service, which generates the video. We send a Motion Cinema request only while BytePlus is the only provider OpenRouter lists for that model. OpenRouter lists this host as not keeping prompts and not training on them. How long BytePlus and OpenRouter keep the uploaded image and the generated video until we download it, we have not confirmed	Your Motion Cinema prompt, generation settings and the image you upload if you use one (with location and camera metadata removed). Not your name, email or payment details	OpenRouter: United States. BytePlus: servers in Singapore, Malaysia, the United States, Hong Kong, Indonesia or Japan	OpenRouter as in its row in section 2. BytePlus is engaged by OpenRouter, not by us; we have no direct contract with it. BytePlus publishes a data processing addendum that incorporates the EU Standard Contractual Clauses; we have not confirmed that it governs OpenRouter’s requests. Our transfer impact assessment for this transfer (20 October 2026) is available on request
OpenRouter, Inc., and the inference provider it selects for Kling	Would run the Motion Pro engine (Kling 3.0, developed by Kuaishou). Not yet active: no request goes to them until we update this page and the activation screen	Prompt, generation settings and uploaded image, once active	United States, with onward processing by the model’s provider, possibly outside the US	As in OpenRouter’s row in section 2

The generated images and videos are stored on our own servers in Bulgaria, for the periods in the Privacy Policy. We never give you a provider’s link to a file.

3. Cloudflare sees more than DNS — read this one

All traffic to audexum.com reaches our servers through a Cloudflare tunnel, and TLS terminates at Cloudflare’s edge. Traffic is encrypted from your device to Cloudflare and re-encrypted from Cloudflare to us, but at that hop Cloudflare is technically capable of reading request and response content in the clear. That includes the text you submit for synthesis, the files you upload for dubbing or audiobooks, and the audio we return.

We have no evidence that Cloudflare does read it, and its terms do not permit it to use the content for its own purposes. We are describing a capability, not an allegation. If your risk assessment cannot accept a US-parented edge provider in that position, tell us at [email protected] before you buy, not after.

Two further Cloudflare functions are worth naming explicitly:

Turnstile is a third-party script that loads in your browser on some forms, and it sends your IP address and browser signals to Cloudflare. It is a third-party embed, not a first-party one.
Email Routing handles every message sent to an @audexum.com address. That means a privacy request, a security report, or an abuse complaint you email us passes through Cloudflare before it reaches us.

4. Who is not a sub-processor, and why

Our own speech and language models. Outside the cases in section 2, text-to-speech, speech-to-text, voice cloning, dubbing, audiobook generation and the website chat assistant run on hardware we own and operate in Bulgaria. The exceptions are the V4 voice tier, which always runs on a hosted model, and scheduled windows when our GPUs are unavailable, when requests go through OpenRouter (section 2). Image and video generation never runs on our own hardware; it uses the providers in section 2A. We do not use your inputs or outputs to train, fine-tune or evaluate models.

The free YouTube transcript tool. To fetch a public video’s subtitles we contact YouTube and, as a fallback, Apify. They receive the video address you paste, not your account details.

Umami analytics. We do run product analytics, but the Umami instance is self-hosted on our own servers and served first-party from a path on audexum.com. No analytics vendor receives your data, because there is no analytics vendor. See the Cookie Policy for what it records.

Our own infrastructure. The application database, generated audio files and job directories are on our own machines in Bulgaria. Off-site backups go to a third location we control, on a 30-day window.

5. Notice before a new sub-processor starts

We commit to the following, and it binds us:

Core sub-processors handle data for every account (hosting, payments, email, the default engine of a feature that is on by default). We publish a new or replacement one on this page, and email everyone subscribed under section 6, at least 14 days before it begins processing personal data for us.
Feature sub-processors run only an optional feature or a model you choose, such as an image, video or voice engine. Each is listed here and named where you turn the feature on or pick the model, before any of your data reaches it. Choosing it is your authorisation; an account that never uses the feature sends it nothing.
Each notice names the entity, the service it provides, the data it will receive, the processing location, and the transfer mechanism if it sits outside the EEA.
You may object on reasonable data-protection grounds by emailing [email protected]: within 14 days of a core notice, or at any time for a feature sub-processor. Tell us what your concern is; we will reply.
If we cannot resolve your objection, you may stop using the affected part of the Service or close your account, and we will refund credits you have bought and not used. You do not lose unused credits because you objected.
Where a change is urgent — a provider fails, or a security problem forces a replacement — we may act first and notify as soon as we can. Your right to object and to the refund above still applies, it simply runs from the notice.
If your account accepted a version before 3.6 and has not accepted 3.6, you keep the 30 days' notice that version promised.

This section is about sub-processors only. It does not narrow any other right you have under our Terms, our Refund Policy or consumer law.

6. Get told by email

Email [email protected] with the subject line subscribe: sub-processors and we will add your address to the notification list for this page. We use that address for nothing else, and you can leave by replying “unsubscribe”.

This is a small operation and the list is maintained by hand. Reading this page before a renewal is a reasonable belt-and-braces check.

7. Questions and complaints

Data-protection questions about this list: [email protected]. Contract and DPA questions: [email protected]. Security matters: [email protected].

You can also complain to a supervisory authority. Ours is the Commission for Personal Data Protection (Комисия за защита на личните данни), www.cpdp.bg. You may complain in the EU or EEA country where you live instead.