RealVideoCreator Service Providers, Subprocessors & Transfer Locations

Effective Date: August 6, 2026 Version: 1.1 Last Verified: August 6, 2026

This page identifies the principal third-party service providers, processors, subprocessors, and international processing locations used by Real Labs Development ("Real Labs," "RealLabs," "we," "us," or "our") in connection with RealVideoCreator.

It supplements the:

• RealVideoCreator Global Privacy Policy;
• RealVideoCreator Terms of Service;
• RealVideoCreator Regional Privacy & Consumer Rights Addendum; and
• VoiceLab 18+ Consent, Biometric & Voice Data Notice, and Permitted Use.

This page is intended to provide transparency concerning where RealVideoCreator information is hosted or processed and which external providers may receive personal information.

The exact legal role of a provider may depend on the service and processing involved. A provider identified on this page may act as a processor, subprocessor, service provider, contractor, or independent controller for particular processing activities.

This page does not replace any data-processing agreement, international-transfer agreement, Standard Contractual Clauses, UK transfer instrument, or other contractual safeguard that applicable law requires Real Labs or a provider to maintain.

1. Primary RealVideoCreator Infrastructure

RealVideoCreator's primary production environment is hosted on infrastructure provided by IONOS.

IONOS

Provider: IONOS

Service Category: Production hosting and infrastructure

Purpose:

• Production server hosting;
• Compute;
• Application hosting;
• Primary database storage;
• Media storage;
• Project storage;
• VoiceLab storage;
• Voice-processing infrastructure;
• AI-generation infrastructure;
• Background processing;
• Internal service communications; and
• Related production infrastructure.

Primary Processing / Hosting Location: United States

Last Verified: August 6, 2026

Real Labs currently operates its production RealVideoCreator environment on United States-based IONOS infrastructure.

Information Processed

The IONOS-hosted environment may contain:

• Account information;
• User identifiers;
• Project information;
• Prompts;
• Scripts;
• Uploaded images;
• Uploaded video;
• Uploaded audio;
• Generated images;
• Generated video;
• Generated audio;
• Project metadata;
• Transaction-related application records;
• Security information;
• Audit records;
• VoiceLab recordings;
• Voice samples;
• Voice embeddings;
• Feature vectors;
• Voice profiles;
• Voice-model information;
• VoiceLab consent records;
• Generated VoiceLab narration; and
• Other information necessary to operate RealVideoCreator.

Real Labs Control

Real Labs administers the software, databases, processing workers, storage structure, application services, and locally operated AI and voice-processing components running inside this environment.

IONOS provides the underlying hosting and server infrastructure.

For privacy and data-processing purposes, IONOS is therefore treated as a third-party infrastructure provider even though Real Labs directly controls the software environment operating on that infrastructure.

2. VoiceLab Data Location

Current VoiceLab Architecture

Under the current RealVideoCreator architecture, VoiceLab is primarily processed inside the Real Labs-controlled IONOS production environment in the United States.

The following VoiceLab information is currently stored and processed within that environment:

• Enrollment recordings;
• Voice samples;
• Technical voice characteristics;
• Embeddings;
• Feature vectors;
• Voice templates;
• Voice profiles;
• Voice-model information;
• Consent records;
• VoiceLab processing records;
• Generated narration;
• Locally generated audio; and
• Related VoiceLab security and audit information.

Local Voice Engines

Real Labs currently operates the following voice technologies within its own IONOS-hosted production environment:

• Chatterbox;
• OpenVoice V2;
• PyTorch;
• CUDA-supported processing; and
• Related internal voice-processing components.

These components run within Real Labs' controlled infrastructure.

They are not independent external subprocessors merely because Real Labs uses their software.

No Public Voice Processor

Real Labs does not currently send VoiceLab enrollment recordings, embeddings, feature vectors, private voice profiles, or locally maintained voice models to a public voice marketplace.

Real Labs does not operate a public marketplace for VoiceLab profiles.

OpenAI Boundary

OpenAI is used for certain AI-assisted RealVideoCreator functionality as described below.

Under the current VoiceLab architecture, Real Labs does not intentionally transmit VoiceLab enrollment recordings, private VoiceLab embeddings, private voice profiles, or locally maintained VoiceLab models to OpenAI as part of ordinary VoiceLab enrollment or local voice synthesis.

If Real Labs introduces a feature that explicitly transmits covered voice information to OpenAI or another external AI provider, Real Labs will update its disclosures and obtain any additional consent required by applicable law before materially expanding such processing.

3. Confirmed External Providers

The following providers are currently used in production.

3.1 OpenAI

Provider: OpenAI

Service Category: AI model and generation provider

Purpose:

• AI-assisted generation;
• Processing prompts;
• Processing scripts;
• Processing project text;
• Responding to user-requested AI operations; and
• Processing related generation metadata.

Last Verified: August 6, 2026

Information Potentially Transmitted

Depending on the RealVideoCreator feature invoked, information may include:

• Prompts;
• Scripts;
• Project text;
• Generation instructions;
• Relevant contextual information;
• Generation parameters; and
• Technical request metadata.

Only information reasonably necessary to perform the selected OpenAI-powered function should be transmitted.

VoiceLab Information

Under the current VoiceLab architecture, OpenAI is not the storage or primary processing provider for VoiceLab enrollment recordings, embeddings, private voice profiles, or locally maintained voice models.

Those materials remain within the Real Labs-controlled IONOS environment unless Real Labs expressly introduces and discloses a feature requiring different processing.

Processing Location

Configuration-dependent / multiple potential locations

OpenAI offers different data-residency and regional-processing configurations depending on account eligibility, project configuration, endpoint, model, and service.

Real Labs does not make a narrower public representation concerning the geographic location of OpenAI processing until the applicable Real Labs OpenAI production configuration has been verified.

OpenAI may use infrastructure, affiliates, or subprocessors in multiple jurisdictions in accordance with applicable service agreements, data-processing terms, and Real Labs' account configuration.

Transfer Status

Information sent from Real Labs' United States environment to OpenAI may be processed in the United States or another applicable location depending on the configured OpenAI service.

Where international data-transfer law applies, Real Labs will use the applicable transfer mechanisms described in the Global Privacy Policy and Regional Privacy & Consumer Rights Addendum.

3.2 PayPal

Provider: PayPal

Service Category: Payment and subscription provider

Purpose:

• Checkout;
• Payment processing;
• Subscription creation;
• Subscription renewal;
• Subscription cancellation;
• Refunds;
• Payment reversals;
• Chargebacks;
• Payment disputes;
• Payment verification; and
• Fraud or transaction management.

Last Verified: August 6, 2026

Information Potentially Processed

PayPal may process information including:

• Payer identifiers;
• Email or account identifiers;
• Transaction identifiers;
• Subscription identifiers;
• Amounts;
• Currency;
• Payment status;
• Renewal information;
• Cancellation information;
• Refund information;
• Reversal information;
• Dispute information; and
• Other payment-related information.

Real Labs does not store full payment-card numbers or card security codes when those credentials are processed directly by PayPal.

Processing Location

Global, including the United States

PayPal operates internationally and may process personal information in the United States and other countries.

Legal Role

PayPal may act independently with respect to portions of payment processing, fraud prevention, regulatory compliance, and operation of its own payment service.

PayPal's own privacy terms apply to its independent processing.

3.3 Cloudflare Turnstile

Provider: Cloudflare

Service: Cloudflare Turnstile

Service Category: Bot detection, abuse prevention, and security

Purpose:

• Distinguishing legitimate users from automated activity;
• Preventing bot abuse;
• Protecting registration and other forms;
• Preventing automated attacks;
• Security monitoring; and
• Protecting RealVideoCreator infrastructure.

Last Verified: August 6, 2026

Information Potentially Processed

Depending on the interaction and Turnstile configuration, Cloudflare may process technical information including:

• IP address;
• Browser information;
• User agent;
• Device or browser characteristics;
• Request information;
• Security signals;
• Challenge information;
• Challenge AI usage;
• Approximate source country; and
• Other technical telemetry used for bot detection.

Processing Location

Global Cloudflare infrastructure

Turnstile uses Cloudflare's global network.

Security processing may therefore occur through infrastructure located in or near the visitor's region and through other locations used by Cloudflare to operate the service.

VoiceLab Information

Cloudflare Turnstile does not receive VoiceLab enrollment recordings, VoiceLab embeddings, private voice profiles, or voice models as part of Real Labs' intended Turnstile implementation.

3.4 Google OAuth

Provider: Google

Service: Google OAuth / Google Sign-In

Service Category: Authentication provider

Purpose:

• User authentication;
• Login;
• Account linking; and
• Account-security functionality.

Last Verified: August 6, 2026

Information Potentially Processed

Depending on the permissions granted, information may include:

• Google account identifier;
• Email address;
• Name;
• Basic profile information;
• Authentication AI usage;
• Login information; and
• Related security metadata.

Real Labs requests only the information reasonably necessary for the authentication functionality being used.

Processing Location

Global Google infrastructure

Google operates infrastructure in multiple jurisdictions.

The precise processing location may depend on Google's systems, account configuration, and services used.

Legal Role

Google may independently process information associated with a user's Google account under Google's own privacy terms.

VoiceLab Information

Google OAuth does not receive VoiceLab enrollment recordings, embeddings, private voice profiles, or voice models as part of the intended authentication process.

3.5 Google Workspace / Gmail / SMTP

Provider: Google

Service: Google Workspace / Gmail / SMTP

Service Category: Transactional email and communications infrastructure

Purpose:

• Account emails;
• Transactional messages;
• Security notifications;
• Subscription communications;
• Required legal notices;
• Support communications; and
• Other service-related email.

Last Verified: August 6, 2026

Information Potentially Processed

Information may include:

• Recipient email address;
• Sender information;
• Email subject;
• Email body;
• Account or transaction information contained in a message;
• Delivery information;
• Message timestamps; and
• Related email metadata.

Users should not send unnecessary sensitive information or VoiceLab recordings by email unless specifically requested through an appropriate support process.

Processing Location

Google infrastructure; region depends on applicable Workspace configuration

Eligible Google Workspace configurations may use data-region controls for covered data.

Where Real Labs has configured an applicable Google Workspace data region, covered data will be handled according to the applicable Google data-region configuration.

Information outside the scope of an applicable data-region policy may be processed in other locations where Google or its subprocessors maintain infrastructure.

Real Labs does not represent that all Google Workspace processing occurs in a particular country unless that configuration has been verified.

VoiceLab Information

Google Gmail / SMTP is not used as the primary storage or processing location for VoiceLab enrollment recordings, embeddings, private voice profiles, or voice models.

4. Current Provider Summary

5. Self-Hosted Components That Are Not Separate Subprocessors

The following technologies currently operate within Real Labs' controlled IONOS environment.

They do not independently receive RealVideoCreator user information as external hosted services merely because their software is installed or operated by Real Labs.

Current self-hosted components include:

• PostgreSQL;
• Redis;
• Celery;
• Django;
• Gunicorn;
• Chatterbox;
• OpenVoice V2;
• PyTorch;
• CUDA-supported processing;
• FFmpeg; and
• Real Labs-controlled local filesystem / MEDIA_ROOT storage.

These technologies are components of the RealVideoCreator production environment rather than separate external data-processing destinations.

Use of an open-source or locally installed software component does not by itself constitute an international transfer of personal information.

6. Model Downloads and Software Acquisition

Real Labs may obtain software, source code, libraries, packages, or AI-model files from external repositories or software providers.

A provider used only to distribute software or model files to Real Labs is not treated as a RealVideoCreator subprocessor solely because Real Labs downloads software from that provider.

For example, downloading a model or software package from an external repository does not itself mean RealVideoCreator user information is transmitted back to that repository.

If an external hosted inference API, telemetry feature, analytics service, or other remote processing service is later enabled and receives personal information, the applicable provider will be added to this page where appropriate.

7. Providers Not Currently Listed as Active Subprocessors

Real Labs lists providers on this public page only after confirming that the provider is actively used in a manner involving relevant RealVideoCreator personal information.

Potential, experimental, inactive, marketing-only, model-download-only, or unverified services are not listed as current processors or subprocessors merely because their software, website, integration code, account, or model may exist.

Providers not currently published as active data processors include, without limitation, services that have not been verified as receiving production personal information.

A provider will be added where appropriate if Real Labs activates the service and personal information is transmitted to that provider.

8. International Transfers

Real Labs Development is located in the United States.

RealVideoCreator's primary production environment is also currently hosted in the United States.

Users located outside the United States should therefore understand that use of RealVideoCreator generally involves a transfer of personal information to the United States.

Certain external providers may additionally process information in other jurisdictions as described on this page.

Where applicable law restricts international transfers, Real Labs will use an applicable legal mechanism.

Depending on the jurisdiction, these mechanisms may include:

• Adequacy decisions or regulations;
• Standard Contractual Clauses;
• The UK International Data Transfer Agreement;
• The UK Addendum to EU Standard Contractual Clauses;
• Other contractual safeguards;
• Transfer-risk assessments;
• Supplementary technical or organizational safeguards;
• Other legally recognized transfer mechanisms; or
• A permitted statutory exception where applicable.

Additional information appears in the RealVideoCreator Global Privacy Policy and Regional Privacy & Consumer Rights Addendum.

9. European Economic Area Transfers

Where EU GDPR transfer restrictions apply, Real Labs may use:

• A European Commission adequacy decision;
• European Commission Standard Contractual Clauses;
• Another appropriate safeguard permitted under Articles 46 or 47 of the GDPR; or
• A legally available Article 49 derogation where applicable.

Where legally required, Real Labs will assess transfer risks and implement supplementary contractual, organizational, or technical measures.

Users may contact Real Labs to request additional information concerning applicable safeguards and information about how to obtain a copy of applicable contractual protections, subject to legitimate confidentiality limitations.

10. United Kingdom Transfers

Where United Kingdom data-protection transfer restrictions apply, Real Labs may use:

• UK adequacy regulations;
• The International Data Transfer Agreement;
• The UK International Data Transfer Addendum to European Commission Standard Contractual Clauses;
• Another approved safeguard; or
• A legally available exception.

Where required, Real Labs will perform the applicable transfer-risk assessment or other legally required analysis.

11. Other International Transfer Requirements

Where applicable law in another jurisdiction imposes international-transfer requirements, Real Labs will use the legally required or permitted mechanism.

This includes applicable requirements under privacy laws in jurisdictions such as:

• Brazil;
• Canada;
• Australia;
• New Zealand;
• Switzerland;
• Japan;
• Singapore;
• India; and
• Other jurisdictions in which RealVideoCreator is legally offered.

12. VoiceLab Transfer Rule

VoiceLab is subject to heightened privacy controls.

Under the current architecture:

VoiceLab enrollment recordings, private embeddings, feature vectors, voice profiles, and locally maintained voice models are hosted in the Real Labs-controlled IONOS environment in the United States.

They are not intentionally distributed among the ordinary external providers listed on this page merely because those providers perform unrelated functions such as:

• Payments;
• Login authentication;
• Email delivery; or
• Bot detection.

OpenAI is not used as the ordinary storage or local synthesis provider for VoiceLab enrollment recordings, private embeddings, feature vectors, private voice profiles, or locally maintained voice models.

Real Labs will not materially change the external processing of covered VoiceLab biometric or sensitive information without updating applicable disclosures and obtaining any additional consent required by applicable law.

VoiceLab remains:

18+ and strictly self-voice only.

13. Security and Data Minimization

Real Labs seeks to limit personal information disclosed to each provider to information reasonably necessary for the provider's function.

Examples include:

• PayPal receives payment-related information rather than VoiceLab models;
• Cloudflare receives security and browser telemetry rather than VoiceLab recordings or project media;
• Google OAuth receives authentication-related information rather than VoiceLab enrollment data;
• Gmail receives information necessary to deliver relevant communications; and
• OpenAI receives information reasonably necessary for the specific OpenAI-powered operation invoked by the user.

Real Labs uses contractual, technical, administrative, and organizational protections appropriate to the provider, information, and processing involved.

Where applicable law requires a data-processing agreement, confidentiality commitment, security provision, transfer safeguard, or similar contractual protection, Real Labs will maintain the applicable agreement or safeguard.

14. Downstream Subprocessors

Some external providers used by Real Labs may themselves rely on affiliates, cloud infrastructure providers, subprocessors, or other downstream processors.

Where Real Labs acts as controller and an external provider acts as a processor, Real Labs expects the processor relationship to be governed by applicable data-processing terms.

Where required by applicable law, those terms must address matters including:

• Confidentiality;
• Security;
• Processing only on documented instructions where applicable;
• Assistance with applicable data-protection obligations;
• Deletion or return of information;
• Audit or compliance information;
• International-transfer protections where required; and
• Use of downstream subprocessors.

Where GDPR, UK GDPR, or similar processor rules apply, appointment of a downstream subprocessor is subject to the legally required authorization framework, which may include prior specific authorization or general written authorization subject to applicable notice and objection procedures.

Where required, the processor must impose data-protection obligations on the downstream subprocessor that provide protections appropriate to and consistent with the processor's own obligations.

The original processor remains responsible for its downstream processing obligations to the extent provided by applicable law and the relevant contractual framework.

Real Labs may rely on provider-maintained subprocessor lists, contractual notices, or equivalent mechanisms to monitor material downstream-subprocessor changes where legally appropriate.

A provider's public subprocessor list or contractual framework does not by itself eliminate Real Labs' own obligations under applicable data-protection law.

Because external providers may change their infrastructure or downstream processors, geographic locations may change over time.

For that reason, this page uses descriptions such as "Global" or "Configuration-dependent" where Real Labs cannot accurately guarantee processing within a single country.

15. Changes to Providers

Real Labs may add, remove, or replace service providers as RealVideoCreator evolves.

This page will be updated when a material change affects the providers or transfer locations disclosed here.

Where applicable law, a data-processing agreement, contractual commitment, or other binding requirement requires advance notice of:

• A new processor;
• A new subprocessor;
• A material provider change; or
• A material processing-location change,

Real Labs will provide the required notice.

Where applicable law provides an objection right concerning a new subprocessor, Real Labs will handle that right in accordance with the applicable contractual and legal framework.

Real Labs will not rely solely on an update to this page to authorize a materially different use of VoiceLab biometric or sensitive information when applicable law requires additional notice or consent.

16. Requests for Additional Information

Users may request additional information concerning:

• Service providers;
• Processors;
• Subprocessors;
• Downstream subprocessors;
• Processing locations;
• Data residency;
• International transfers;
• European Commission Standard Contractual Clauses;
• UK transfer safeguards;
• Transfer-risk assessments;
• Supplementary safeguards;
• VoiceLab processing locations; or
• Other applicable privacy protections.

Requests may be submitted to:

legal@realvideocreator.com

Information concerning contractual safeguards may be subject to reasonable redaction or confidentiality restrictions where necessary to protect confidential business information, provider information, security information, or third-party rights.

17. Accuracy and Verification

Real Labs seeks to keep the information on this page accurate and current.

Provider infrastructure, service configurations, subprocessor relationships, and geographic processing arrangements can change.

The Last Verified date indicates when Real Labs most recently reviewed the provider information reflected on this page.

A Last Verified date does not mean a provider's entire global infrastructure was independently audited by Real Labs.

Where Real Labs learns that a material provider or processing-location disclosure is no longer accurate, Real Labs will update this page within a reasonable period and will provide any additional notice required by applicable law.

18. Contact

Real Labs Development 1043 Pinegrove Dr Holland, MI 49423 United States

Privacy, Data Protection, Subprocessor, and Transfer Questions: legal@realvideocreator.com

Current VoiceLab Hosting Summary

For clarity:

Primary VoiceLab hosting: IONOS Primary VoiceLab processing location: United States VoiceLab external public voice processor: None under the current ordinary architecture Public voice marketplace: None

Current VoiceLab enrollment recordings, embeddings, feature vectors, voice profiles, and locally maintained voice models remain within the Real Labs-controlled IONOS environment during ordinary VoiceLab processing.

VoiceLab is strictly 18+ and strictly self-voice only.

Another person's permission or consent does not create an exception.