Subprocessors
The companies that process personal data for Rebel Audio, what each one does, which data it handles and where.
Last updated · Version 2026-10-20-v1
1. What this page is
A subprocessor is a company that processes personal data for Rebel Audio so we can provide the Service. Each one is bound by a written agreement to process data only on our instructions, only for the purpose listed here, and with security measures at least as protective as ours; each uses its own safeguards, such as the Standard Contractual Clauses or the EU-US Data Privacy Framework, for transfers out of the European Economic Area, the United Kingdom and Switzerland. The companies in section 3 are not subprocessors. The Privacy Policy explains what we collect and why; this page says who else touches it. "Location" is where the provider processes the data for us. Unless stated otherwise it is the United States.
Where you are the controller of personal data we process for you (the people in your recordings, the guests and crew you credit, the mail your show receives), our Data Processing Addendum forms part of the Terms, and section 2 of this page is its current Annex III.
2. Current subprocessors
| Subprocessor | What it does for us | Data it handles | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Hosting, databases, media storage and processing, AI models (Amazon Bedrock), video and audio encoding (MediaConvert), transactional and show email (SES), backups and logs | Everything the Service stores: account, workspace, content, transcripts, derived outputs, billing references, listener logs, show email, support requests | United States (Oregon); Amazon Bedrock may answer an AI request from an Amazon data centre in another region or country, without storing it there |
| Cloudflare, Inc. | Delivery of published media and feeds to podcast apps, players and listeners | Published media files and feeds; listener IP addresses and user agents in transit | Global edge network; logs in the United States |
| Clerk, Inc. | Sign-in, sessions, workspaces (organisations) and team invitations | Name, email address, profile photo, how you sign in (email or Google), session tokens, workspace membership | United States |
| Stripe, Inc. | Subscriptions, add-ons, metered dubbing, invoices, the billing portal, and creator payouts (Stripe Connect) | Name, email address, billing address, payment method (held by Stripe only), plan and invoice history; for payouts, the bank, identity and tax details Stripe collects (held by Stripe only) | United States |
| ElevenLabs, Inc. | Transcription, dubbing into other languages, generated music (Vibe Scoring) | The audio you transcribe or dub, the transcript text to dub, and the mood and tempo description used to generate music; processed under terms that do not allow ElevenLabs to use your audio to train its AI. It may keep a copy for a limited time under those terms; for dubs, we ask it to delete the project as soon as the dub is ready. Dubs use ready-made voices; no voice is cloned | United States |
| OpenRouter, Inc. | A back-up route to AI language models from Anthropic and OpenAI, used when Amazon Bedrock cannot answer a request | The text of the request, including what Ask Rebel reads to answer you (for example passages of your transcripts and your show's details), the episode text a draft is written from, and the answer; sent only to model providers that do not use it to train AI and do not keep it | United States |
| Google LLC | Sign in with Google, Google Drive import | Google account profile; the Drive files you pick. See the Privacy Policy's Google user data section | United States (global) |
| Dropbox, Inc. | Import of the files you pick from Dropbox | The files you pick and their name, size, type and revision; the connection's access token | United States |
| PostHog, Inc. | Product analytics and masked session recordings, only after you accept analytics; cookieless page-view counts where the law allows | Usage events, device and browser type, approximate location, your account identifier after consent; never your content | United States |
| Slack Technologies, LLC | Alerts to our support team when a support or bug request arrives | The request's kind, title, area and a short excerpt; never your name, email address, account identifier or attachments | United States |
3. Other companies that receive data when you use a feature
These companies receive data when you use the feature named, as independent companies under their own terms and privacy policies, not on our instructions.
| Company | What it does | Data it handles | Location |
|---|---|---|---|
| Google LLC (YouTube) | Publishing to the YouTube channel you connect, and reading its statistics | YouTube channel, playlist and video identifiers and statistics; the videos, titles and descriptions you publish. See the Privacy Policy's Google user data section | United States (global) |
| Spotify AB | Listing your show on Spotify and reporting its listening statistics | Show and episode metadata and feed; the listening statistics Spotify reports for your show | Sweden and the United States |
| Apple Inc. | Submitting your show's feed to Apple Podcasts on your behalf | Show and episode metadata and feed | United States |
| Podcast Index LLC | Finding a show by its name or feed address when you import it into Rebel (Podcast Index is a free, public list of podcasts that many podcast apps use) | The words you search for, or the feed address you paste | United States |
The platforms you publish to yourself — a podcast app reading your feed, an Amazon Music or other podcast app listing — are not subprocessors either: once you publish, each receives your public content directly under its own terms. Within your workspace, your team members are not subprocessors; they act for you.
4. Changes to this list
We update this page and its version whenever we add, replace or remove a subprocessor. When the change is material — a new kind of provider, or a provider that will see a new category of your data — we tell account holders in the app or by email at least 14 days before it takes effect where practical, so you can raise an objection with us; where a change must happen sooner for security or availability reasons we tell you as soon as we can. If you object and we cannot address it, you may close your account and we refund the unused part of any prepaid fees. For personal data you control, the notice and objection terms in section 4 of the Data Processing Addendum apply as well. Earlier versions are available on request.
History
- 20 October 2026: the list is split into subprocessors and other companies that receive data when you use a feature; the OpenRouter and ElevenLabs rows say exactly what each may keep.
- 19 October 2026: PostHog, Inc. named as our analytics provider.
- 16 October 2026: OpenRouter, Inc. was added as a back-up route to AI models (listed on this page on 19 October 2026).
5. Contact
Questions about a subprocessor, or to ask for the safeguards that apply to your data: engineering@rebelaudio.ai.