Subprocessors
*Last updated: October 1, 2025*
Cast.app (“Vendor”) uses the third parties below to provide the Services. “Subprocessor” means a third party engaged by Vendor that may process Customer Personal Data on Vendor’s behalf while delivering the Services.
Notice of Changes
We will (i) keep this page up to date, (ii) give at least 30 days’ prior notice before adding or replacing a Subprocessor by updating this page and notifying Customer via the notice mechanism in the Agreement or the admin console, and (iii) honor a 15-day objection window on reasonable data-protection grounds. If unresolved, Customer may suspend the affected Service or terminate the impacted order for a pro-rata refund of prepaid, unused fees.
Core Platform & Operations (always in scope)
| Entity (Legal Name) | Purpose | Processing location(s) | Typical personal data categories |
|---|---|---|---|
| Google Cloud Platform (Google LLC) | Cloud hosting (compute, storage, databases), networking, backups; monitoring via Google Cloud Operations Suite (“Stackdriver”) | U.S. and/or EU regions used by the Service | Account/admin contact info; authentication identifiers; content uploaded/processed by the Service; usage/telemetry; limited support artifacts shared by Customer |
| Twilio SendGrid, Inc. | Transactional email delivery (invites, alerts, notices) | U.S./EU | Recipient name and email; message metadata; limited template variables |
Note: “Monitoring (GCP)” in prior drafts is covered under Google Cloud Platform above.
Optional AI Feature Providers (only if Customer enables AI Features)
Cast designs prompts to avoid PII by default (PII-free prompt construction). When Customer enables AI Features or provides its own keys/proxy, the providers below may process inputs/outputs necessary to fulfill the request.
| Entity (Legal Name) | Purpose | Processing location(s) | Typical personal data categories |
|---|---|---|---|
| OpenAI, L.L.C. | LLM inference for text generation/rewrite | U.S./EU (per provider) | No Customer Personal Data by default; de-identified inputs/outputs and service metadata. If Customer enables features or supplies content containing personal data, that content may be processed to fulfill the request. |
| Anthropic PBC | LLM inference for text reasoning/generation | U.S./EU (per provider) | Same as OpenAI. |
| Google (Gemini; Cloud Translation API) | LLM inference and machine translation | U.S./EU (per provider) | Same as OpenAI. |
| ElevenLabs, Inc. | Text-to-speech (audio narration) | U.S./EU (per provider) | Text to be synthesized (typically de-identified) and service metadata. |
| Amazon Web Services, Inc. (Amazon Polly) (if enabled) | Text-to-speech | U.S./EU (per provider) | Text to be synthesized (typically de-identified) and service metadata. |
Data Protection
All Subprocessors are bound by written data-processing terms no less protective than the DPA between Customer and Cast.app, including confidentiality, security, and transfer mechanisms (e.g., SCCs where applicable).
How to Object
To object to a proposed Subprocessor addition/replacement on reasonable data-protection grounds within the 15-day window, use the notice method in your Agreement (or the admin contact in the console). We will work in good faith to resolve; if not resolved, you may suspend the affected Service or terminate the impacted order for a pro-rata refund.
Historical Changes
- 2025-10-01: Initial publication of consolidated Subprocessor List and objection workflow.