Subprocessors

Effective June 18, 2026 · Last updated October 1, 2026

This page lists the third-party subprocessors that The Cur8 Group Corp. (“CreateBase,” “we,” “us,” or “our”) engages to help deliver our platform, website, and applications (collectively, the “Services”). It applies to all users of the Services and supplements our Privacy Policy and, for enterprise customers, our Data Processing Agreement (DPA).

1. What a Subprocessor Is

A Subprocessor is a third party that we engage to process Personal Data or other customer data on our behalf in order to provide, support, or improve the Services. Subprocessors include providers of cloud infrastructure and hosting, database and authentication, payments, bank connections, tax forms, email delivery, scheduling, and AI processing.

2. Our Commitment

EVERY SUBPROCESSOR WE ENGAGE IS CONTRACTUALLY BOUND BY CONFIDENTIALITY AND DATA-PROTECTION OBLIGATIONS THAT ARE NO LESS PROTECTIVE THAN THOSE IN OUR OWN AGREEMENTS WITH YOU.

Before engaging a Subprocessor, we conduct appropriate diligence and enter into a written agreement that requires the Subprocessor to: (a) keep your data confidential; (b) implement and maintain appropriate technical and organizational security measures; (c) process data only as necessary to provide their services to us and on our instructions; and (d) comply with applicable data-protection laws. We remain responsible for the performance of our Subprocessors' obligations.

3. Current Subprocessors

Subprocessor	Purpose	Types of data	Location
Amazon Web Services, Inc.	Cloud infrastructure and hosting for our app, its API, and file storage	Account and profile data, uploaded documents and catalog data, outputs, technical and log data	United States
Netlify, Inc.	Hosting for createbase.com, including the call-booking form	Booking details (name, email, chosen time, notes), technical and log data such as IP address	United States
Supabase, Inc.	Database, authentication, and server functions for our app	Account and profile data (such as name, email, phone number, artist and songwriter names), login data, uploaded content and outputs
Clerk, Inc.	Sign-in and account authentication	Name, email address, sign-in credentials, session and device data
Stripe, Inc.	Payments, billing, and fraud prevention	Payment card details, billing name and address, email, transaction records, device and browser data used for fraud prevention	United States
Plaid Inc.	Connecting bank accounts	Account details needed to pay you. You sign in to your bank through Plaid; we do not receive your bank password.	United States
Track1099	Collecting and validating tax forms (W-9 and W-8)	Legal name, address, tax classification, and taxpayer identification number (such as SSN or EIN)	United States
Twilio Inc. (SendGrid)	Email delivery, such as invitations you send to collaborators	Recipient email address, sender name, and the content of the email, including any message text you or our AI tools add	United States
Google LLC	Google Workspace calendar and Google Meet for calls booked on our website; Google Fonts loaded by the payment form in our app	Booking details (name, email, call time, notes); for fonts, IP address and browser information	United States
Lovable	Development platform used to build our current app	Technical data such as IP address and browser information
Anthropic, PBC	AI processing	Uploaded documents and content, and your prompts	United States

4. AI Subprocessors — No Training on Your Data

ANTHROPIC IS CONTRACTUALLY BOUND NOT TO TRAIN ITS MODELS ON CREATEBASE CUSTOMER DATA. We engage this AI provider under commercial terms that prohibit it from using your data to train, fine-tune, or improve its models. It processes your uploads solely to return results to us for delivery to you and keeps them only for the limited period its terms allow, for purposes such as abuse monitoring.

5. Change Notification

We may add, replace, or remove Subprocessors as our Services evolve. When we intend to engage a new Subprocessor or replace an existing one, we will update this page and, where required by our agreements or applicable law, provide advance notice to affected customers. To receive notifications of changes to this list, or to learn how to subscribe to updates, contact us at legal@createbase.com. Enterprise customers should refer to their DPA for the specific notice period and any objection rights that apply to new Subprocessors.

6. Contact

Questions about this page or our Subprocessors can be directed to legal@createbase.com.

This page supplements our Privacy Policy and our DPA.