Sub-Processors
Last updated: April 3, 2026
In accordance with GDPR Article 28, this page lists the third-party sub-processors that Audora Music (operated by Metalmedia Group AB) engages to deliver its services. Each sub-processor has been assessed for appropriate data protection measures.
1. Infrastructure & Database
Supabase Inc.
Purpose: Database hosting (PostgreSQL), authentication, file storage, edge functions
Data processed: User accounts, profiles, content metadata, file storage, authentication tokens
Location: AWS EU-West (Frankfurt, Germany)
Netlify Inc.
Purpose: Frontend hosting, CDN, deployment
Data processed: Static website assets, access logs (IP addresses)
Location: Global CDN with primary servers in USA/EU
2. Payments
Stripe Inc.
Purpose: Payment processing, subscription management, payouts
Data processed: Payment card details (PCI DSS compliant — Audora never handles raw card data), billing address, transaction history
Location: USA with EU data residency options
DPA: stripe.com/legal/dpa
3. Email & Communications
Resend Inc.
Purpose: Transactional and newsletter email delivery
Data processed: Email addresses, email content, delivery status
Location: USA
DPA: resend.com/legal/dpa
4. Analytics
Google LLC (Google Analytics 4)
Purpose: Website analytics, usage patterns, performance monitoring
Data processed: Anonymized usage data, page views, device/browser info, cookies
Location: USA (with EU adequacy measures via Standard Contractual Clauses)
DPA: Google Data Processing Terms
Note: GA4 is only loaded with explicit user consent (cookie banner) and is suppressed when Global Privacy Control (GPC) is detected.
5. AI & Machine Learning
Audora uses AI services to power creative tools (text generation, image generation, video generation). User content sent to these services is used only for immediate processing and is not used to train their models.
OpenAI Inc.
Purpose: Text generation (marketing copy, bios, descriptions)
Data processed: User prompts, artist profile context, generated text
Location: USA
Anthropic PBC
Purpose: Text generation (alternative AI provider)
Data processed: User prompts, artist profile context, generated text
Location: USA
Google LLC (Vertex AI / Gemini)
Purpose: Text and content generation
Data processed: User prompts, artist profile context, generated content
Location: EU (europe-west1) / USA
DPA: Google Cloud DPA
Replicate Inc.
Purpose: AI video and image generation
Data processed: User prompts, input images, generated media
Location: USA
6. Changes to This List
We may update this sub-processor list from time to time as we add or change service providers. Material changes will be communicated via the platform. If you have concerns about a specific sub-processor, please contact us at hello@audora.music.
7. Legal Basis
All sub-processors are engaged under appropriate data processing agreements (DPAs) in compliance with GDPR Article 28. For transfers outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, adequacy decisions, or other lawful transfer mechanisms.