Legal
Sub-processors
Last updated 11 October 2026.
Zipplee are operated by Custom Ai Apps LLC. To run the product, we use the following third-party sub-processors. Each handles a defined function and processes only the data needed for that function.
| Name | Purpose | Data processed | Location |
|---|---|---|---|
| Supabase | Database, authentication, storage, and edge functions | All application data | United States (on AWS) |
| Amazon Web Services | Underlying cloud infrastructure for Supabase | All application data | United States |
| Netlify | Static hosting and content delivery network (CDN) | Published content and static assets | Global edge network |
| Cloudflare | DNS and web application firewall | Traffic in transit | Global edge network |
| Railway | Document and video rendering | Document content during render; nothing retained | United States |
| OpenAI | AI text generation, transcription, and grading | Prompts, content, and audio submitted to AI features | United States |
| Google (Gemini API) | AI image generation, video and document reading, and voice for practice conversations | Prompts, content, images, audio and video submitted to those AI features | United States and other Google Cloud regions |
| Resend | Sending email from Zipplee (invitations, reminders, notifications) | Recipient names and email addresses, and the content of each email | United States |
| ElevenLabs | Text-to-speech narration | The text to be spoken. No identifier is sent. | United States |
| HeyGen | Generated presenter video | An authored narration script, a stock avatar identifier, and an opaque tag. No customer data. | United States |
| Daily.co | Live video rooms | Audio and video of participants who join a call, in transit | United States |
| Whereby | Live video rooms (alternate path) | Audio and video of participants who join a call, in transit | United States / EU |
| Twilio | SMS notifications and alerts | Phone numbers and message content | United States |
We will notify customers of material changes to this sub-processor list — such as adding a new sub-processor — and provide a reasonable opportunity to raise legitimate data-protection concerns before the change takes effect. We do not sell customer data, and we do not permit our AI providers to train their models on customer content.
Questions: todd@customaiapps.ai. See also our Trust & Security page and Data Processing Agreement.