Sub-processors

Last Updated: October 21, 2026

1. About This List

Hinto AI is a trading name of Vertex Tree LTD, a company registered in England and Wales under company number 15229327. To provide our Service, we engage third-party companies ("sub-processors") that may process personal information on our behalf. This page lists our current sub-processors and the purpose for which each is used.

We require each sub-processor to provide a level of data protection consistent with our obligations under applicable data protection law, including the UK GDPR and EU GDPR, and to process personal information only as needed to perform their services. Where a sub-processor is located outside the UK or EEA, transfers are protected by an appropriate safeguard, such as an adequacy decision or Standard Contractual Clauses (together with the UK International Data Transfer Addendum where relevant).

2. Infrastructure and Hosting

  • Supabase — Database, authentication, and file/media storage for your account, content, and uploaded recordings. Hosting location: European Union. Attestation: SOC 2 Type II, ISO 27001.
  • Vercel — Hosting and delivery of our marketing site and published customer sites. Hosting location: United States / global edge network. Attestation: SOC 2 Type II, ISO 27001.
  • Hetzner Online GmbH — Application hosting and media processing, and off-site backup storage. Hosting location: European Union (Germany). Attestation: ISO/IEC 27001:2022.
  • GitHub — Source code hosting, build pipeline, and container image registry for the Service. Location: United States. Attestation: SOC 3, ISO/IEC 27001:2022.

3. AI and Content Generation

We use an AI provider to turn your recordings into documentation. It processes your uploaded video and audio, and the text derived from them, only to produce your output. Under its paid API terms, that content is not used to train its models.

  • Google (Gemini API) — AI model provider for processing video, audio, and text to generate documentation. Location: United States. Attestation: SOC 1, SOC 2, SOC 3.

4. Payments

  • Lemon Squeezy — Payment processing and merchant of record for subscriptions and one-time purchases, including tax handling. Location: United States. Attestation: PCI DSS.

5. Communications and Support

  • Loops — Transactional and marketing email (for example, account, billing, and product communications). Location: United States. Attestation: SOC 2 Type II.

6. Analytics and Monitoring

  • Amplitude — Product usage analytics within our application. Location: United States. Attestation: SOC 2 Type II, SOC 1 Type 2, ISO 27001 with 27017 and 27018.
  • Google Analytics — Website and published-site analytics. Location: United States. Attestation: covered by Google SOC reports.
  • Swetrix — Privacy-focused website analytics. Location: European Union. Attestation: none published; states GDPR alignment and open source code.
  • Vercel Analytics — Aggregate traffic analytics on our websites and published pages. Location: United States. Attestation: SOC 2 Type II, ISO 27001.
  • Sentry — Application error and performance monitoring. Location: United States. Attestation: SOC 2 Type II, ISO 27001.

7. Changes to Our Sub-processors

We may add or replace sub-processors as our Service evolves. When we make a change that affects the processing of personal information, we will update this page and the "Last Updated" date above. Customers who have entered into a Data Processing Agreement with us may subscribe to be notified of changes to this list, and may object to a new sub-processor as set out in that agreement.

8. Contact

For questions about our sub-processors, or to request notification of changes, contact us at contact@hintoai.com.