Effective date: 1 October 2026 · Version 2026-10-01
Cask Studio uses the third-party providers below to operate the service. Each processes personal data on our behalf and only on our instructions. The last column shows the data-processing terms that bind each provider under Art 28 GDPR and their current status. Where a provider processes data outside the European Economic Area, the transfer basis column shows the safeguard we rely on.
Infrastructure and operations
| Provider | Purpose | Data | Location | Transfer basis | Processing terms |
|---|---|---|---|---|---|
| Hetzner Online GmbH | Hosting: application servers, database, cache, and file storage | All account, job, and billing records; uploaded files, generated outputs, and synced projects | EU (EEA); file storage in Germany | None needed — within the EEA | Hetzner's Art 28 data-processing agreement, signed |
| Cloudflare, Inc. | DNS, CDN, and TLS proxy in front of our websites and API | IP addresses, request metadata, and the traffic passing between you and us | Global network; United States | EU–US Data Privacy Framework; Standard Contractual Clauses | Cloudflare Data Processing Addendum, part of Cloudflare's service terms |
| Stripe Payments Europe, Ltd. | Payments and subscriptions | Name, email, billing address, payment details, purchase history; analytics app-instance ID, only if you opted in to app analytics | Ireland (EEA); Stripe, Inc. processes some data in the United States | EU–US Data Privacy Framework; Standard Contractual Clauses | Stripe Data Processing Agreement, part of the Stripe Services Agreement |
| Resend (Plus Five Five, Inc.) | Transactional email | Recipient email, subject, message body | Emails sent from Ireland (EU region); company in the United States | Standard Contractual Clauses | Resend Data Processing Agreement, executed on sign-up |
| Apple Inc. | Push notifications to the Cask apps (Apple Push Notification service) | Device token, notification text | United States | EU–US Data Privacy Framework | Apple Developer Program License Agreement |
| Functional Software, Inc. (Sentry) | Crash and error reports from the Cask apps, only if you agree; you can change this in Preferences | Error details, stack trace, app and macOS version, device model, Cask account ID and plan | Stored in Germany (EU region); company in the United States | Standard Contractual Clauses for any access from outside the EEA | Sentry Data Processing Addendum, part of Sentry's terms of service |
| Google Ireland Limited (Google Analytics for Firebase) | App analytics in the Cask apps, only if you opt in; purchase events sent by our server for users who opted in | Screens and features used, app-instance ID, Cask account ID and plan, app and OS version, device model, approximate location; for purchases: checkout reference, amount, currency, product | Ireland (EEA); Google may process data in the United States | EU–US Data Privacy Framework; Standard Contractual Clauses | Google Ads Data Processing Terms |
| Google Ireland Limited (Google Analytics 4) | Website analytics on cask.studio, only with your consent | Pages viewed, clicks, approximate location, device and browser, referrer | Ireland (EEA); Google may process data in the United States | EU–US Data Privacy Framework; Standard Contractual Clauses | Google Ads Data Processing Terms |
AI generation
We send your prompts and uploaded media to the provider that runs the model you choose. Cask does not train AI models on your content. The last column shows what each provider has agreed about training.
| Provider | Purpose | Data | Location | Transfer basis | Processing terms | Training on your data |
|---|---|---|---|---|---|---|
| OpenAI Ireland Ltd (for users in the EEA) | Text and image generation | Prompts, input media, outputs | Processed in the United States by OpenAI, L.L.C. | Standard Contractual Clauses | OpenAI Data Processing Addendum, signed | Not used for training (API data) |
| Google LLC and its affiliates (Vertex AI on Google Cloud) | Text, image, music, and speech generation | Prompts, input media, outputs | Models run on Google's global infrastructure, including the United States | EU–US Data Privacy Framework; Standard Contractual Clauses | Google Cloud Data Processing Addendum, part of the Google Cloud terms | Not used for training |
| fal - Features & Labels, Inc. | Image and video generation | Prompts, input media, outputs | United States | Standard Contractual Clauses (Module 2), part of fal's data-processing addendum | fal Data Processing Addendum, part of fal's terms of service. fal holds a SOC 2 Type II report. | No contractual promise for our account; fal's addendum allows it to use de-identified data to improve its services. We switch off fal's payload storage on every request; generated files are private and deleted from fal's storage one hour after they are created. |
| Byteplus Pte. Ltd. (ModelArk) | Image and video generation | Prompts, input media, outputs | Singapore | Standard Contractual Clauses (no EU adequacy decision for Singapore) | BytePlus Data Processing Addendum, part of the BytePlus customer agreement | Not confirmed in writing |
| RunwayML, Inc. | Video generation — not currently used | None while unused | United States | — | None in place. Runway's models are switched off and we will not send it data until a data-processing agreement is in place. | Not confirmed |
Changes to this list
We keep this list current. For business customers, we give at least 30 days' notice by email before we add or replace a subprocessor that will process their personal data, or materially change what an existing subprocessor does with it, so they can object. Where a change is needed urgently, for example to keep the service secure or running, we give notice as soon as we can. Other users can see changes here; the effective date and version above show when this list last changed.
How we protect the data these providers handle is on our Trust Center. The Privacy Policy says what we collect and why.