EditPilot for DaVinci Resolve — Sub-processors
EditPilot uses the service providers below to run the account and licensing systems. Each is bound by a data processing agreement and handles only what is described here. EditPilot never sends any of them your footage, audio, transcripts or projects. We will update this list before adding a new provider.
| Provider | What it does for EditPilot | Personal data it handles | Where |
|---|---|---|---|
| Supabase, Inc. | Runs customer accounts: sign-in, the account database, the list of signed-in computers, the Messages board, and the pre-launch waitlist | Name, email, hashed password, marketing choice and its record, computer identifiers and names, sign-in times; for Google, GitHub, Apple or Facebook sign-in, the profile details the provider shares; sign-in logs including IP address and app details | Canada (Central). Supabase is a US company and its infrastructure is provided by Amazon Web Services |
| An email sending service (not yet chosen) | Will send account emails such as address confirmation and password reset. EditPilot does not send these today | Name, email address, and the email's content | Named here before it is used |
| Cloudflare, Inc. | Runs the license service that checks paid licenses | A one-way hash of the license key and an encrypted copy of it; plan and expiry; identifiers of activated computers with first- and last-seen times. No email address or IP address is stored. IP addresses pass through Cloudflare's network in transit. | Cloudflare's global network |
| Namecheap, Inc. (Private Email) | Receives and stores customer support email sent to support@editpilotdavinci.com | Whatever a customer includes in an email, and any support report they attach | United States |
| Meta Platforms (Meta Platforms Ireland Limited for visitors in the EEA and UK; Meta Platforms, Inc. elsewhere) | The Meta pixel: measures our advertisements and shows them again to people who visited the website, on Facebook and Instagram. One pixel covers both. Only after the visitor accepts cookies, and not in use on the website today | Cookie and advertising identifiers, IP address, browser and device details, the pages visited on our site. Never your EditPilot account, your license, or anything about your footage | Meta's own infrastructure, including the United States |
| Google (Google Ireland Limited for visitors in the EEA and UK; Google LLC elsewhere) | The Google tag: builds advertising audiences and measures how the website is used. Our YouTube channel is linked inside Google Ads, so no separate YouTube tracker is loaded here. Only after the visitor accepts cookies | The same as above | Google's own infrastructure, including the United States |
| Cloudflare, Inc. (website) | Hosts and serves the website itself, and runs the waitlist form on it: the form posts to Cloudflare, which checks it is not a bot and passes the address to Supabase | For the website: IP addresses in transit, as every host sees. For the waitlist: the email address you type, and a short-lived one-way hash of your IP address used only to limit repeated submissions. Your IP address is not stored. | Cloudflare's global network |
Advertising platforms are different from the rest of this list. They are reached from the visitor's browser, not from our systems, and only after that visitor accepts. Under EU law they are more likely to be joint controllers with us for what the pixel collects than processors acting on our instructions; the arrangement each platform offers is accepted before their tags go live.
Not sub-processors, and why:
- Google, GitHub, Apple and Facebook (Meta), when a customer chooses to sign in with them, are identity providers acting under their own terms: the customer signs in on the provider's own page and EditPilot never sees that password.
- Gumroad and aescripts sell EditPilot plans as merchants in their own right and handle purchases under their own privacy policies.
- Hugging Face, GitHub, the Python Package Index, PyTorch and Meta host files that EditPilot downloads. EditPilot sends them no personal data; they see the IP address of any download, as every file host does.
- OpenAI and Anthropic are used only if a customer connects their own account, with their own key, directly from their own computer.