Subprocessors

Effective June 18, 2026 · Last updated June 18, 2026

This page lists the third-party subprocessors that The Cur8 Group Corp. (“CreateBase,” “we,” “us,” or “our”) engages to help deliver our platform, website, and applications (collectively, the “Services”). It applies to all users of the Services and supplements our Privacy Policy and, for enterprise customers, our Data Processing Agreement (DPA).

1. What a Subprocessor Is

A Subprocessor is a third party that we engage to process Personal Data or other customer data on our behalf in order to provide, support, or improve the Services. Subprocessors include providers of cloud infrastructure and hosting, database and authentication, payments, identity verification, AI processing, and internal communications.

2. Our Commitment

EVERY SUBPROCESSOR WE ENGAGE IS CONTRACTUALLY BOUND BY CONFIDENTIALITY AND DATA-PROTECTION OBLIGATIONS THAT ARE NO LESS PROTECTIVE THAN THOSE IN OUR OWN AGREEMENTS WITH YOU.

Before engaging a Subprocessor, we conduct appropriate diligence and enter into a written agreement that requires the Subprocessor to: (a) keep your data confidential; (b) implement and maintain appropriate technical and organizational security measures; (c) process data only as necessary to provide their services to us and on our instructions; and (d) comply with applicable data-protection laws. We remain responsible for the performance of our Subprocessors' obligations.

3. Current Subprocessors

Subprocessor	Purpose	Location
Amazon Web Services, Inc.	Cloud infrastructure and hosting	United States
Vercel Inc.	Frontend hosting	United States
Netlify, Inc.	Hosting and deployment	United States
Supabase, Inc.	Database and authentication	United States
Stripe, Inc.	Payments	United States
Persona Identities, Inc.	Identity verification and KYC	United States
OpenAI, L.L.C.	AI processing	United States
Anthropic, PBC	AI processing	United States
Slack Technologies, LLC	Internal communications	United States

4. AI Subprocessors — No Training on Your Data

OPENAI AND ANTHROPIC ARE CONTRACTUALLY BOUND NOT TO TRAIN THEIR MODELS ON CREATEBASE CUSTOMER DATA. We engage these AI providers on zero-retention and no-train tiers, under which they process your uploads solely to return results to us for delivery to you, do not retain your data beyond what is necessary to provide that processing, and do not use it to train, fine-tune, or improve their models.

5. Change Notification

We may add, replace, or remove Subprocessors as our Services evolve. When we intend to engage a new Subprocessor or replace an existing one, we will update this page and, where required by our agreements or applicable law, provide advance notice to affected customers. To receive notifications of changes to this list, or to learn how to subscribe to updates, contact us at legal@createbase.com. Enterprise customers should refer to their DPA for the specific notice period and any objection rights that apply to new Subprocessors.

6. Contact

Questions about this page or our Subprocessors can be directed to legal@createbase.com.

This page supplements our Privacy Policy and our DPA.