Subprocessors

Version 1.0
Effective date: August 21, 2026
Last updated: August 21, 2026

This page lists the third parties Cutvey LLC uses to run its products, and that may process personal data on our behalf. It is part of the Cutvey Privacy Policy and is incorporated into our Data Processing Addendum.

Every party on this list processes data for us under written terms (their data processing terms, our agreement, or both) that limit them to providing their service to us, and that require confidentiality and appropriate security. None of them is an advertising network or a data broker, and none may use the data for advertising. One of them, our email provider, holds correspondence you send us rather than data from a workspace. Two of them also act on their own account for part of what they do, and we say which and why below, rather than implying a control we do not have.

Current subprocessors

Where a provider above receives personal data protected by EEA, UK or Swiss law, we have Standard Contractual Clauses in place with it, with the UK Addendum where relevant.

Contact details. Each provider publishes a privacy contact in its own privacy policy. If you need the current contact details for any provider on this list, for a data subject request, for Annex III of the Standard Contractual Clauses, or for your own records, email [email protected] and we will send them to you. We keep them rather than reprint them here, so that this page cannot go stale about somebody else's address.

Independent controllers

Two of the companies above also act on their own account, not only on ours, and it would be misleading to present them purely as our subprocessors.

• Stripe is our processor for the billing data we send it. It is also an independent controller for its own fraud prevention, financial-crime and regulatory obligations. What it does in that capacity is governed by Stripe's own privacy policy, not by ours.
• Apple is our processor for the push tokens we send it. It is an independent controller for App Store purchases, receipts and your Apple Account, and for your own private iCloud database, which we cannot read. What Apple does in those capacities is governed by Apple's privacy policy.

Corporate group

Cutvey LLC currently has no affiliates or group companies that process personal data. If that changes, they will be listed here.

Not subprocessors

For clarity, these process data, but not on our behalf:

• Apple's own crash sharing. Your Apple device may send crash information to us through Apple's own developer channel, if you turned that on in your device settings. That is Apple's mechanism under Apple's terms, and you control it there rather than in our apps. Crash reports our apps send themselves go to the crash-reporting provider in the table above and, where an app supports it, to our own servers, on the consent basis described in section 8 of the Privacy Policy.
• Our own crash and error endpoint. Error reports from the Service, and crash reports from apps that support it, also go to an endpoint we run ourselves on app.cutvey.com. That is us, not a third party, so it is not on the list above.
• Apple, for App Store distribution and in-app purchases. When you buy or download an App, Apple acts for itself under its own terms, not on our behalf. The App confirms the purchase with Apple on your device. Nothing about that purchase is sent to us, and we do not receive your payment details.
• A studio's own Stripe account. When a studio's client pays an invoice, the money and the payment data go to the studio's own Stripe account, under the studio's own relationship with Stripe. Cutvey never holds those funds.
• A destination you configure yourself in an App, such as your own storage bucket, a network drive, or a webhook. Your files go where you send them, under your own arrangements.
• Your Apple Account and iCloud, when you sync an app's data to your own private iCloud database. That relationship is between you and Apple.

Changes to this list

We keep this list current, and we do not add a subprocessor quietly.

• Subscribe to notifications. Any customer can subscribe to subprocessor change notices by emailing [email protected] with "Subprocessor notifications" in the subject line. Workspace owners and billing contacts are subscribed by default.
• Advance notice. Before we add a new subprocessor, or replace an existing one, we notify subscribers at least 30 days in advance by email, and we update the "Last updated" date on this page.
• Where we must move faster. Sometimes we have to act sooner: to keep the service running, to fix a security or reliability problem, or because a provider gives us less than 30 days' notice of its own change. Then we notify subscribers as soon as we reasonably can instead. The right to object below then runs from the date of that notice.
• Right to object. For processing where Cutvey acts as a processor on a business customer's behalf, that customer may object in writing to a new subprocessor within 30 days of the notice, on reasonable grounds relating to data protection. We will work with the customer in good faith to find an alternative or a mitigation. If we cannot, the customer may terminate the affected subscription by written notice given within that 30-day window. Termination takes effect at the end of the customer's current paid period, and no refund or proration is given, consistent with our Terms of Service. Until then, where technically possible, we will keep that customer's data off the new subprocessor. Where that is not possible, the customer may instead end the subscription immediately, again without refund. The full terms of this right are in our Data Processing Addendum.
• Removals do not require notice, though we will note them here.
• When this page changes, the version it replaces will be kept at https://cutvey.com/legal/archive, with the date each version took effect, so you can show which list was in force when you accepted.

Questions: [email protected].