Data processors

Third parties to which user information may be transferred on behalf of NEON LION. This list is maintained under ZZPL Article 45 / GDPR Article 28 and referenced in Privacy Policy §5 and Terms §6.1.5.

How to read the table

“Training on user data” describes the particular provider’s policy, not the Operator’s. The Operator does not train its own models on user data.
“Depends on terms” means the provider allows data to be used to improve its own models depending on the tier or integration type — see the links to its terms.
If a user disagrees with a provider’s terms, they may choose another AI model in the Service interface or refrain from using the relevant feature (Terms §6.1.5).
Links are current at publication. Providers’ terms may change — consult their websites directly for current details.

Processor	Purpose	Region	Training on user data	Terms
Supabase Supabase Inc.	PostgreSQL database and object storage (Storage)	EU (Frankfurt)	No	Privacy DPA
Vercel Vercel Inc.	Next.js hosting and execution, request-content processing, cookie-free visit statistics	Main functions: EU Frankfurt fra1; service operations under Vercel terms	No	Privacy DPA
Cloudflare Cloudflare, Inc.	DNS, CDN, SSL, DDoS protection, incoming email routing; backup storage in R2, encrypted locally before transfer	R2: EU jurisdiction; other services: US / global CDN	No	Privacy DPA
Upstash Upstash, Inc.	Redis cache: rate limiting and request idempotency	EU (Frankfurt)	No	Privacy
Resend Resend Inc.	Transactional email delivery and storage of service records	US; the sending region does not determine the storage location	No	Privacy DPA
Payment provider (direct acquirer) Stripe Payments Europe Ltd. Planned The Stripe adapter is implemented; new live payments are disabled. An adapter does not confirm a paid launch or completed tax setup.	Card payment processing, card data storage under PCI-DSS Level 1, invoicing. Acts on behalf of the Operator; the Operator is the seller on the receipt.	EU (Ireland)	No	Privacy DPA
Payment provider (merchant of record, if connected) Paddle.com Market Limited Planned Connection is not confirmed. If activated, MoR mode applies under Terms Appendix A.1; the sale contract is then between the User and Paddle, rather than directly with the Operator.	Alternative mode: the provider acts as merchant of record, selling directly to the user and calculating and remitting VAT/sales tax in users’ jurisdictions.	UK / EU	No	Privacy Terms DPA
OpenRouter (Google Gemini) OpenRouter Inc. + Google LLC	AI generation: Nano Banana Pro / Flash (Gemini 3 Pro / 2.5 Flash Image). Gemini Vision also receives EVERY uploaded image for the mandatory check for minors (Terms §7.3). It also processes messages, screenshots, product photos and account details for the replies of the built-in Neon Lion assistant (Privacy §3.5.1)	US	Depends on terms Under Google’s terms, the paid Gemini API tier does not use data for training. See Google’s terms.	Privacy Terms
fal.ai Features & Labels, Inc.	AI generation: Seedream 5.0 Pro (ByteDance) for photos; Seedance 2.0 (ByteDance) and Kling v3 (Kuaishou) for video; Qwen Edit is present in the backend but unavailable in the UI	US	Depends on terms fal.ai expressly reserves model providers’ right to use input for improvement under their terms. See fal.ai and ByteDance model terms.	Privacy Terms
OpenAI OpenAI, L.L.C.	AI editing of product images (GPT Image 2). omni-moderation-latest also receives EVERY uploaded image for the mandatory prohibited-content check (Terms §7)	US	No API requests are not used for training by default since 2023 (OpenAI API policy). Enterprise / API tier only.	Privacy Terms DPA
Replicate Replicate, Inc. Fallback	Legacy video flow (Kling v2.1); the main new Kling flow runs through fal.ai	US	Depends on terms Depends on the model and its owner’s terms. Kling is a Kuaishou model; see their public terms.	Privacy Terms
PixelCut Pixelcut Inc.	Background removal; fallback after local ONNX for a photo declared to contain a face requires additional confirmation	US	No	Privacy Terms
PostHog PostHog Inc.	Website usage analytics (loaded only after cookie consent)	EU (EU hosting)	Not applicable Not an AI provider. Receives usage events and technical identifiers. Absence of source content in an event does not guarantee full anonymity.	Privacy DPA
BetterStack Better Stack s.r.o.	External uptime monitoring (ping /api/ping)	EU	Not applicable Receives no personal data. Availability status only.	Privacy
Online support chat provider Crisp IM SARL (France) or Tidio LLC (US) Planned Not connected: no provider key is configured, the script does not load and nothing is transmitted to the chat.	Support chat widget: messages written by the user and technical session data. Loaded only after consent to analytics cookies	EU (Crisp) / US (Tidio)	Not applicable Support correspondence is not used to train our models. See the links below for the provider’s policy.	Privacy Terms
Telegram (Bot API) Telegram FZ-LLC	Service alerts to the administrator (error IDs, not user content)	UAE	Not applicable Receives service identifiers and error types. Identifiers are not guaranteed to be anonymous. Ticket text and names are excluded from SLA notifications; earlier messages require a separate retention review.	Privacy Terms

Changes to the processor list are published on this page. Active users are also notified by email of material changes (a new AI provider, region change or training-policy change) 30 days before they take effect (Privacy §11).

Загрузка...