Data Subprocessors

Last updated: April 1, 2026

Townshub Limited engages the following third-party subprocessors to operate the UGC Studio platform. Each processor has been vetted for GDPR compliance. We maintain Data Processing Agreements (DPAs) with all subprocessors where required.

We will update this page at least 30 days before adding a new subprocessor that materially changes how your data is processed. For questions, contact support@townshub.com.

Processor	Purpose	Data Processed	Location	Privacy Policy
Supabase	Database hosting, authentication, and file storage	Account credentials, profile data, campaign data, content metadata, messages	EU (AWS eu-west-1 / eu-central-1)	View
Stripe	Payment processing, escrow management, Stripe Connect payouts	Payment card data, bank account details, transaction history, identity verification	USA / EU (PCI-DSS Level 1 certified)	View
OpenAI	AI-powered creator-campaign matching and content quality scoring (GPT-4o)	Creator profile excerpts, campaign briefs, content metadata (when AI processing consent is given)	USA	View
Google Analytics	Platform usage analytics and performance measurement	Anonymised usage events, page views, device type, browser (no PII sent)	USA / EU (Consent Mode v2 — only active with analytics consent)	View
Vercel	Web application hosting and edge delivery	IP addresses (for edge routing), request logs retained for 24 hours	Global CDN (primary: EU regions)	View

Processor

Purpose

Data Processed

Location

Supabase

Database hosting, authentication, and file storage

Account credentials, profile data, campaign data, content metadata, messages

EU (AWS eu-west-1 / eu-central-1)

View

Stripe

Payment processing, escrow management, Stripe Connect payouts

Payment card data, bank account details, transaction history, identity verification

USA / EU (PCI-DSS Level 1 certified)

View

OpenAI

AI-powered creator-campaign matching and content quality scoring (GPT-4o)

Creator profile excerpts, campaign briefs, content metadata (when AI processing consent is given)

USA

View

Google Analytics

Platform usage analytics and performance measurement

Anonymised usage events, page views, device type, browser (no PII sent)

USA / EU (Consent Mode v2 — only active with analytics consent)

View

Vercel

Web application hosting and edge delivery

IP addresses (for edge routing), request logs retained for 24 hours

Global CDN (primary: EU regions)

View

International Data Transfers

Some subprocessors (OpenAI, Google Analytics, Stripe) process data in the United States. These transfers are covered by Standard Contractual Clauses (SCCs) as approved by the European Commission, ensuring an adequate level of protection equivalent to that within the EEA.

Your Rights

If you have consented to AI processing, your data may be sent to OpenAI for matching and quality scoring. You can withdraw this consent at any time from your account settings or via the cookie preferences panel. See our Privacy Policy for full details on your GDPR rights.