Subprocessors
These companies process personal data on Pinecast's behalf. Each one receives only the information that it needs to do its job.
This list is current as of October 21, 2026. Organizations with a Pinecast contract will receive 30 days of notice by email before subprocessors are added or replaced.
| Subprocessor | Purpose | Personal data processed | Location | Agreements |
|---|---|---|---|---|
| Amazon Web Services (Amazon Web Services, Inc.) | Hosting: application and analytics databases, file storage, compute, data streams, sending and receiving email | All categories: account data, podcast content (audio, images, show notes, transcripts), listener analytics, feedback and email, server logs | United States (us-east-1) | DPA · Subprocessors |
| Cloudflare (Cloudflare, Inc.) | DNS, TLS, web application firewall and caching for Pinecast's websites, feeds and audio | IP address, user agent and URL of each request while it passes through. The email address and password typed on the sign-in, sign-up and password reset pages, checked in a hashed form against known data breaches and not kept. Stores only cached public content (feeds and audio). | Cloudflare's global network | DPA · Subprocessors |
| Cloudflare Workers AI (Cloudflare, Inc.) | Spam screening of free accounts; listener-feedback summaries, and cover art with a description of each image, when a creator asks | Podcast and episode names, descriptions, links and audio file names; the domain of the owner's email; the text of feedback messages (not the sender's email or IP); for cover art, the creator's words about its look and the image that is made | Cloudflare's network; GPU capacity from CoreWeave (US) and Nebius (UK). Customer content is not used for training and inputs are not retained | DPA · Data usage · Subprocessors |
| Bunny.net (BunnyWay d.o.o., Slovenia) | Content delivery network for podcast audio | Listener IP address and user agent for each audio request (logs anonymized, kept 3 days); public audio files | Global edge network | GDPR and DPA · Subprocessors |
| Stripe (Stripe, LLC) | Subscription and tip payments; identity verification and payouts for tip jar owners | Creator and tipper email; payment, identity and bank details, which are entered directly with Stripe and never pass through Pinecast | United States and other Stripe locations | DPA · Service providers |
| AssemblyAI (AssemblyAI Inc.) | Episode transcription | Episode audio, including anyone speaking in it; the transcript and speaker labels | United States. Opted out of model training; audio and transcripts deleted after 1 day | DPA · Trust center |
| LiveKit (LiveKit Incorporated) | Studio live recording sessions | Live audio and video, display name and IP address of hosts and guests | LiveKit Cloud, US region | DPA · Subprocessors |
| Rollbar (Rollbar, Inc.) | Error monitoring | Signed-in creator's user ID and email; visitor IP address, page URL and browser details with error context | United States | GDPR and DPA · Subprocessors |
| Help Scout (Help Scout PBC) | Support mailbox, help center, dashboard help widget | Creator email, support messages and attachments | United States | DPA · Subprocessors |
| Userlist (Userlist, Inc.) | Account and product email to creators | Creator email, user ID, sign-up date, Stripe IDs, product events | United States | DPA · Subprocessors |
| Slack (Slack Technologies, LLC) | Internal alerts to Pinecast staff about possible spam or terms violations | Owner email address, podcast and episode titles | United States | DPA |
| Google reCAPTCHA (Google LLC) | Bot checks on sign-up, tip jar sign-in and feedback forms | Visitor IP address, browser details, interaction signals | United States and Google's network | Google Cloud DPA · Subprocessors |
| Mapbox (Mapbox, Inc.) | Maps in dashboard analytics | Creator IP address, browser details, map tile requests. No listener data | United States | DPA · Subprocessors |