Legal & Compliance
Subprocessors
Last updated: June 2026 · We notify customers of material changes 30 days in advance.
Overview
Mimr Studio uses the following third-party subprocessors to deliver its services. Each subprocessor is bound by a Data Processing Agreement (DPA) consistent with GDPR Article 28, and is assessed annually for security and compliance posture.
All subprocessors listed here may process customer content (uploaded documents, generated course content, and associated metadata) to the extent required to deliver the specified service.
AI & Content Generation
| Subprocessor | Purpose | Data processed | Location | DPA |
|---|---|---|---|---|
| OpenAI, Inc. | Course content generation, narration scripts, quiz questions, scenario writing via GPT-4o | Uploaded source documents, generated lesson content | United States (SOC 2 Type II certified) | DPA ↗ |
Text-to-Speech & Audio
| Subprocessor | Purpose | Data processed | Location | DPA |
|---|---|---|---|---|
| ElevenLabs, Inc. | Neural text-to-speech narration for course audio | Narration scripts (no personal data unless included in source material) | United States | Privacy policy ↗ |
Presenter Video (optional feature)
Only applies when the AI presenter video feature is enabled for your workspace.
| Subprocessor | Purpose | Data processed | Location | DPA |
|---|---|---|---|---|
| HeyGen Inc. | AI avatar video generation for presenter intro and per-slide clips | Narration scripts, generated video output | United States | Privacy policy ↗ |
Infrastructure & Storage
| Subprocessor | Purpose | Data processed | Location | DPA |
|---|---|---|---|---|
| Supabase Inc. | Database (PostgreSQL) and object storage for job files, account data, and generated assets | All customer and account data | EU (eu-west-2) or US depending on workspace region | Privacy policy ↗ |
| Render Inc. | Application hosting, job runner, background workers | Application processing — data in transit only | United States (Ohio) | Privacy policy ↗ |
| Subprocessor | Purpose | Data processed | Location | DPA |
|---|---|---|---|---|
| SendGrid (Twilio Inc.) | Transactional email delivery — account invites, job completion notifications, GDPR request confirmations | Email addresses, notification content | United States (SOC 2 Type II certified) | Privacy policy ↗ |
Change notifications
We will notify customers with active subscriptions of any material changes to this subprocessor list at least 30 days in advance by email to the account's primary contact address. Customers who object to the addition of a new subprocessor may terminate their subscription in accordance with the Terms of Service.
To receive change notifications or request a copy of our subprocessor DPAs, contact privacy@mimrstudio.com.
