1.Overview
To deliver the VidScore platform, the VidScore Enterprise Data product, and related Services, VidScore engages a limited set of third-party service providers. Each provider listed below is a sub-processor under applicable data protection law, including the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
VidScore publishes this page so that customers, regulators, and prospective buyers can review the full list of sub-processors, their purpose, and the categories of personal data each sub-processor processes on behalf of VidScore customers.
2.What is a Sub-processor
A "sub-processor" is a third-party entity engaged by VidScore to process personal data on behalf of a VidScore customer, under instructions documented in the Data Processing Agreement. Each sub-processor is bound by a written agreement with VidScore that imposes data protection obligations substantially similar to those in the VidScore DPA, including confidentiality, security, and breach notification requirements.
VidScore remains responsible to Customer for the performance of each sub-processor's obligations under the DPA.
3.Current Sub-processors
The tables below list every sub-processor VidScore currently engages, grouped by function. Each row identifies the sub-processor name, the legal entity, the purpose of processing, the categories of personal data processed, the location of processing, and a link to the sub-processor's published security information.
Hosting and Infrastructure
| Sub-processor | Purpose | Data Categories | Location | Security |
|---|---|---|---|---|
Supabase Supabase Inc. | Primary database, authentication, storage, and edge functions for the VidScore™ platform and enterprise portal. | Team member identity (email, name, role), portal activity logs, customer metadata, analysis results, operational data. | United States (AWS, multiple regions) | Supabase Security |
Vercel Vercel Inc. | Web hosting and edge delivery for vidscore.ai and the enterprise customer portal. | HTTP request metadata, IP addresses, user agent strings. | United States (global edge network) | Vercel Security |
Upstash Upstash Inc. | Redis caching for analysis results and rate-limit counters. | Cached API responses, rate-limit counters keyed to IP address. | United States | Upstash Trust |
AI and Analytics
| Sub-processor | Purpose | Data Categories | Location | Security |
|---|---|---|---|---|
Google Cloud Vertex AI (Gemini models) Google LLC | AI-powered analysis of publicly available video transcripts and metadata. Requests are routed to Google Cloud Vertex AI regional endpoints (us-east5, us-west1, europe-west4, asia-northeast1) for failover and latency. The paid Vertex AI API does not use customer data for model training. | Publicly available video transcripts and channel metadata retrieved from YouTube. | United States and other Google Cloud regions (us-east5, us-west1, europe-west4, asia-northeast1) | Google Cloud Security |
Google Knowledge Graph Google LLC | Public identity enrichment for people and brands identified in analyzed content. | Publicly available creator identifiers, public biographical data. | United States | Google Cloud Security |
YouTube Data API Google LLC | Retrieval of public video metadata (title, description, channel information, public view counts). | Public video identifiers and metadata. | United States | Google Cloud Security |
CDN and Network Security
| Sub-processor | Purpose | Data Categories | Location | Security |
|---|---|---|---|---|
Cloudflare Cloudflare Inc. | DDoS protection, Web Application Firewall, DNS, and edge caching for vidscore.ai. | IP addresses, request metadata, bot-detection signals. | United States (global edge network) | Cloudflare Trust Hub |
Payments
| Sub-processor | Purpose | Data Categories | Location | Security |
|---|---|---|---|---|
Stripe Stripe Inc. | Payment processing and subscription management for all paid tiers. | Customer billing contact, last 4 digits of payment card, billing address, subscription status. | United States | Stripe Security |
Communications
| Sub-processor | Purpose | Data Categories | Location | Security |
|---|---|---|---|---|
Resend Resend Inc. | Transactional email delivery: team invitations, delivery notifications, receipts, and security notices. | Recipient email address, recipient name (when provided), email subject and body, delivery status. | United States | Resend Security |
Where a listed sub-processor maintains third-party security attestations (such as SOC 2 Type II or ISO 27001), those certifications apply only to the services each sub-processor provides; they do not extend to VidScore's own operations, code, or data handling practices above the infrastructure layer. VidScore itself is not SOC 2 or ISO 27001 certified.
4.Notification of Changes
VidScore will publish any addition or replacement of a sub-processor on this page at least 30 days before the change takes effect. The 30-day window begins on the date the change is published on this page, which is indicated by the effective date at the top of this document.
Customers who wish to receive email notifications when this page changes may subscribe by contacting [email protected]. VidScore maintains a manual notification list for customers who opt in and will send a change notice to every subscribed address at the time a change is published.
VidScore does not send unsolicited notifications for sub-processor changes. Customers are encouraged to check this page periodically or subscribe via the address above.
5.Customer Right to Object
Customer may object to the addition or replacement of a sub-processor by providing written notice to [email protected] within 30 days of the publication date. The notice must identify the sub-processor and state the reason for the objection.
Upon receipt of a timely objection, VidScore will work in good faith with Customer to address the concern. If VidScore and Customer cannot resolve the objection within 30 days, Customer may terminate the affected portion of the Services in accordance with the termination provisions of the Enterprise Data Terms or the applicable Order Form. No refund is issued for the current billing period.
6.Contact
Questions about this page, objections to a sub-processor, or requests to subscribe to change notifications: [email protected]
VidScore LLC
258 Harvard St, #355
Brookline, MA 02446
Related documents
GDPR Article 28 DPA covering sub-processors, security, and breach notification.
VidScore’s security controls covering access, audit logging, and incident response.
What we collect, why, how long we keep it, and your rights under CCPA and GDPR.