Sub-processors
Last updated: 27 August 2026
Motion Index is operated by CINESUIT AS (organisation number 931 200 909, Rådhusgata 5, 0151 Oslo, Norway), which is the data controller. Below are the companies that process personal data on our behalf, what each one receives, and where it sits. If you are doing a vendor review, this page and the Privacy Policy are what you need.
We keep this list short on purpose. Every entry is a company that can see something about our users, so the bar for adding one is high.
In the EU
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Neon | Database | Everything in Privacy Policy §2 | Frankfurt, Germany |
| Render | Backend hosting | All API traffic, including IP address | Frankfurt, Germany |
| Amazon Web Services (S3) | File and image storage | Uploaded files, cached images | Frankfurt, Germany (eu-central-1) |
Outside the EU, or global
| Sub-processor | Purpose | Data | Location | Transfer basis |
|---|---|---|---|---|
| Vercel | Frontend hosting and CDN | Web traffic, including IP address | US company, global edge network | EU–US Data Privacy Framework and standard contractual clauses |
| Stripe | Payments | Email, name, billing details, transaction records | US, global | Data Privacy Framework and standard contractual clauses |
| Resend | Transactional email and newsletter | Email address, name, message content | US | Standard contractual clauses |
| Anthropic | Reading film credits and filtering frame quality during ingest | Film titles, descriptions and credit text — which can include creator names. No user account data and no search queries. | US | Standard contractual clauses; inputs are not used to train models |
| Cloudflare | Bot protection (Turnstile) on sign-up and sign-in | IP address, browser signals | Global | Data Privacy Framework and standard contractual clauses |
| Telegram | Operational alerts to the founder | A masked email address (t***@example.com), plan tier, sign-up method, profession. If you send us feedback, your message text. Never a full email address, a name, or anything you searched for. | Global | None — see the note below |
Note on Telegram
Telegram does not offer a data processing agreement. We use it only for operational alerts, and rather than rely on a promise we do not have, we mask identifiers in our own code before anything is sent. No full email address, no name, and no search or query text ever reaches it.
We think that is a reasonable position for the alerts, and we are explicit about it rather than leaving it off the list.
Not sub-processors, despite what you might expect
Worth stating, because vendor reviews often ask:
- Google Fonts — we do not use it as a service. Fonts are downloaded when we build the site and served from our own domain, so no request reaches Google and no visitor IP address is shared.
- OpenAI — not used. Our search embeddings are generated on our own servers by an open-source model (OpenCLIP). Nothing is sent to OpenAI.
- Analytics providers — none. No Google Analytics, no PostHog, no session recording, no advertising or tracking networks. Product analytics run on our own database, and you can turn them off in Settings → Privacy.
- YouTube and Vimeo — no data reaches either until you click play on a specific video. See Privacy Policy §5.2.
Changes
We will update this page when a sub-processor is added or removed. If you have a contract with us that requires advance notice of changes, that contract governs.
Questions: hello@motionindex.io