Subprocessors
Last updated: October 6, 2026
A subprocessor is a third party we use to deliver the Service that may handle customer data in the process. This page lists ours, what each one is for, and what reaches it. It is the companion to our Privacy Policy, which governs what we do with your data ourselves.
Layro is a production pipeline, so the longest groups below are the AI providers and the places we search: the work you ask for is by definition carried out by models we do not host, over material we do not own. Nothing in either group receives your account identity — the first receives the material to work on, the second a search query.
1. Infrastructure
Hosting of the application, database, and file storage
Data: All data you store in Layro, at rest in the European Union
DNS and the network edge — every request to the Service passes through it, and TLS terminates there
Data: Connection metadata for every request: your IP address, the address requested, timing, and the request itself in transit
Object storage for durability copies of project media
Data: Media files stored in your projects — files you upload, stock and other material you add, and generated media
2. Identity and payments
Authentication, account records, two-factor enrolment
Data: Email address, credentials (we never see or store your password), session tokens, MFA factors
Sign-in, where you choose to use it instead of an email address and password
Data: The email address and name the provider returns to us when you approve the sign-in
Payments and subscriptions, acting as merchant of record
Data: Billing name and address, payment method (held by Paddle, never by us), tax location, invoice history
Transactional email — account and Picker Seat invitations
Data: Email address and the contents of the message sent to it
3. AI processing
These providers receive the material you ask us to work on: your script text, the audio and images in your project, and the instructions you give. For the voiceover provider you can connect a key of your own under Settings → Integrations, and those calls then run under your agreement with the provider instead of ours.
Language models — script writing, scene analysis, direction
Data: Script text, project brief, and prompts derived from them
Speech recognition for the subtitles workflow
Data: Audio you submit for transcription
Text-to-speech voiceover
Data: Script text to be spoken, and voice settings
Image and video generation
Data: Generation prompts and any reference images you supply
Embeddings used to match footage to scenes
Data: Scene descriptions and candidate footage metadata
4. Research and content discovery
These services receive search queries generated from your script, or the identifier of an item you linked — not the script itself, and not your account details.
Web research for script material
Data: Research questions derived from your topic
Web search for script material
Data: Search queries derived from your topic
Web and image search
Data: Search queries derived from your scenes
YouTube API Services — the title, channel, length and thumbnail of the YouTube videos you link, and the embedded player that plays them. YouTube is not searched on your behalf, and no video is downloaded from it
Data: The identifiers of the YouTube videos you link. The embedded player loads from YouTube in your browser, under the Google Privacy Policy
Licensed stock libraries
Data: Search queries derived from your scenes
Openly licensed footage from an archive.org item you linked yourself: we read the item’s licence and file details and add the file to your project. The archive is not searched on your behalf
Data: The identifier of the archive.org item in the link you added
5. Operations
Error monitoring
Data: Diagnostic data about failures — request paths and stack traces. Request bodies on authentication and conversation endpoints are scrubbed before transmission.
Changes to this list
We update this page when we add or remove a subprocessor. If you have a contract with us that requires advance notice of changes, we honour the notice period in that contract. To be told when this list changes, write to [email protected] and ask to be added to the notification list.
Data processing agreements
If you need a data processing agreement, or a copy of the safeguards we rely on for transfers outside the European Economic Area, write to [email protected] and we will send you our current terms.