Subprocessors
GrabCast uses the service providers below to host and run the Service. They process personal data only on our instructions and under their data processing terms, which include confidentiality and security obligations and, for data from the EEA, the UK and Switzerland, transfer safeguards (see International transfers). This list is part of our Privacy Policy.
Not on this list: tools that run in your browser don't send your files to anyone. Platforms you connect yourself (Facebook, Instagram, Threads, YouTube, TikTok, Bluesky, Mastodon, Google Drive, Dropbox, OneDrive, Box) and AI providers you connect with your own key receive data because you asked us to send it to them, under your own agreement with them.
On this page
1. Hosting, database and storage
| Provider | What it does | Personal data it handles | Location |
|---|---|---|---|
| Google Cloud (Cloud Run) — Google LLC | Main application servers (API) | All data sent to our API: account, Scheduler, Ads manager, AI requests, IP addresses | United States (Iowa) |
| Render — Render Services, Inc. | Backup application servers (same API, used when the main one is unavailable) | Same as above | United States [owner: confirm region] |
| Neon — Neon, Inc. | Database (PostgreSQL) and its short-term backups | Everything we store about accounts and connected services, encrypted tokens and keys | [owner: confirm Neon region] |
| Cloudflare — Cloudflare, Inc. | Content delivery and security for grabcast.click; R2 private file storage (media library, publishing copies); Workers and KV (scheduling triggers); Email Routing and Email Workers (receiving temporary email and forwarding our support addresses); Turnstile (bot protection) | IP addresses and request data; uploaded media; temporary email messages; bot-check signals | Global network; R2 storage location chosen automatically by Cloudflare |
| Firebase Hosting — Google LLC | Serves the website's static pages | IP addresses and request data in server logs | Global network |
2. Email delivery
Service emails (activation, password reset, security codes, notifications you turn on) are sent through one of these providers, chosen automatically to stay within free sending limits:
| Provider | Personal data it handles | Location |
|---|---|---|
| Resend — Plus Five Five, Inc. | Recipient email address, email content, delivery events | United States |
| Brevo — Sendinblue SAS | Same | European Union |
| Mailjet — Mailjet SAS (Sinch) | Same | European Union |
| SMTP2GO — SMTP2GO Ltd | Same | Global (US/EU/other data centers) |
| Google (Gmail SMTP) — Google LLC | Administrative emails only | United States / global |
Emails you send to support@, privacy@ or dmca@grabcast.click are forwarded by Cloudflare Email Routing to our team's mailbox hosted by Google (Gmail).
3. AI providers (GrabCast's free AI)
| Provider | What it does | Personal data it handles | Location |
|---|---|---|---|
| Groq — Groq, Inc. | Generates replies for our free AI text features | The text you enter (prompts); no account details | United States |
| Pollinations.AI | Fallback for free AI text; some image and text tools call it directly from your browser | The prompt you enter; your IP address when called from your browser | Global / unspecified |
We send only the text of your request — never your name, email or account ID — and we don't use your prompts to train AI models. If you connect your own key for a provider (OpenAI, Anthropic, Google Gemini and others), that provider processes your requests under your own account — see AI features and your AI keys.
4. Other services
| Provider | What it does | Personal data it handles |
|---|---|---|
| Browser push services (Google, Mozilla, Apple, Microsoft) | Deliver push notifications you turned on | Your browser's push address and the notification text |
| Google AdSense — Google LLC (only if ads are enabled) | Shows advertising on content pages | Cookie identifiers, IP address, pages viewed (see Advertising) |
| Public content networks (jsDelivr, cdnjs, Google Fonts, Hugging Face) | Deliver open-source code, fonts and AI models some in-browser tools need | IP address and browser details, like any website you load |
5. Infrastructure that doesn't process your personal data
- GitHub (GitHub, Inc.) hosts our source code and runs automated jobs (GitHub Actions) that publish articles and render GrabCast's own marketing images and videos. No user accounts, files or connected-account data are sent to these jobs.
- Cloudflare Workers AI generates GrabCast's own marketing content. It processes your requests only if you connect your own Cloudflare account as an AI provider, under your account (see your AI keys).
- Google Search Console shows us aggregated search statistics about grabcast.click; it contains no data about individual visitors.
6. Updates
We update this page before a new provider starts processing personal data, and change the "Last updated" date above. Questions or objections: privacy@grabcast.click.