1. Status of this register
This is a technical inventory, not an assertion that all listed providers are appointed subprocessors. Their roles depend on the contract and requested feature. No production subprocessor list has yet been approved. Confirm the legal recipient, region, contractual role, DPA, retention and transfer safeguard before enabling customer processing.
2. OpenAI
Purpose: enabled language, vision and research workflows receive prompts, relevant workspace facts and reference media. The API adapter uses Responses with store:false. Provider safety retention may still apply. The local pilot currently uses a developer Codex/ChatGPT account instead; migrate and confirm business API terms and data-processing arrangements before customer production use.
3. Google Gemini
Purpose: image generation, only when connected, receives image prompts and reference images. Confirm an eligible paid Gemini API project and DPA before an EEA-facing release; the current Google terms require paid services for API clients made available to EEA, Swiss and UK users. Confirm retention and locations rather than assuming EU-only processing.
4. Shopify and Meta
Shopify is the customer’s connected commerce platform and receives approved product content, media and theme changes. It also provides account/store information under granted scopes. Meta supplies configured ad reporting; campaign drafts currently stay in Scly. Each platform’s role and terms depend on the customer’s own connection. Platform privacy/deletion mechanisms still need production implementation and testing.
5. Content sources and local media tools
Content discovery may contact public video platforms, web sources and search services. Treat creator identifiers, footage, music and voice as material requiring appropriate data and content rights. FFmpeg and local media analysis are tools on the Scly server, not separate external recipients. Temporary files and download caches must be included in deletion and retention procedures.
6. Production vendors and company access
Hosting, storage, backups, payment processing and support providers have not yet been selected. Document staff access from each company and country; neither G5 HOLDING OÜ nor BIRCHG5WOLF LLC is automatically authorised as the other’s subprocessor or EU representative. Notify customers of relevant changes before appointing additional recipients under the agreed DPA process.