How to read this list
Kulissa uses the providers below to operate kulissa.com and the product. For Customer Content we process as a processor, these are subprocessors under the DPA. For website and Maya demo data we control, they are processors we use as a controller under the Privacy Policy.
We will update this page before a new subprocessor starts processing personal data and give Customers at least 30 days to object under the DPA.
Operator: STEALTH, trading as Kulissa, hello@kulissa.com.
Current subprocessors
| Name | Purpose | Location of processing | Transfer mechanism |
|---|---|---|---|
| Vercel Inc. | Application hosting, edge delivery, Vercel Analytics | United States (and regional edge) | SCCs / provider DPA |
| Supabase, Inc. | Managed Postgres database, authentication storage | As configured for the project; EU preferred where available | SCCs / provider DPA |
| OpenAI, L.L.C. | Language-model inference for roleplay, scoring and generation | United States | SCCs / provider DPA; no training on API customer data per provider terms |
| Google LLC (Gemini) | Language-model and speech-related inference via configured routes | United States | SCCs / provider DPA |
| OpenRouter, Inc. | Routing of some model requests to upstream providers | United States | SCCs / provider DPA |
| Resend, Inc. | Transactional email (confirmations, invites, notifications) | United States | SCCs / provider DPA |
| Plausible Insights OÜ | Cookieless website analytics | European Union (Estonia) | EEA processing |
| Cal.com, Inc. | Optional demo scheduling when the calendar tab is used | United States | SCCs / provider DPA; only if the visitor opens that tab |
Speech-to-text and text-to-speech may run through the model providers above or through the host's configured speech services for a live turn. They process audio to produce a transcript or utterance and are covered by the same no-training commitments where the provider offers them.
Not on this list
- Tools that run only on our internal laptops and never receive Customer Content as a system of record
- Public CDNs used solely for static brand fonts already disclosed in page source (Fontshare for Recoleta)
Changes
Material additions will appear here with a new last-updated date. Customers with an active DPA receive notice as described there.
Contact
hello@kulissa.com with subject [Legal] Subprocessors.
FAQ
Do these providers train on our data?
We contract for inference-only use of Customer Content. OpenAI and comparable API terms prohibit training on API customer data; we do not opt in to training programmes. See AI Transparency.
Can we require EU-only hosting?
Enterprise plans can discuss regional constraints during security review. Default application hosting is Vercel; database region is configured per deployment.
Questions about this document: email hello@kulissa.com with the subject [Legal] Subprocessors.