Overview
This page lists the third-party service providers (“sub-processors”) that Smash Media Inc (dba Heroworks.ai) uses to process personal data on behalf of our customers.
We maintain Data Processing Agreements (DPAs) with all sub-processors to ensure they provide appropriate data protection safeguards.
Current Sub-processors
Infrastructure & Core Services
| Sub-processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Google Cloud Platform | Cloud infrastructure, hosting | All platform data | United States |
| Firebase | Authentication, real-time database, file storage | User accounts, content, files | United States |
| Vercel | Web hosting, CDN, edge functions | Request logs, static assets | Global (US primary) |
AI & Search Services
| Sub-processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Google Gemini | AI chat, intelligent search | Published article content, user queries | United States |
| Google Cloud Translation | Automatic content translation | Article text content | United States |
| Upstash | Vector database for semantic search, article search | Text embeddings, image embeddings, search queries | United States / European Union |
Supporting Services
| Sub-processor | Purpose | Data Processed | Location |
|---|---|---|---|
| [Email Provider - TBD] | Transactional emails | Email addresses, names | [TBD] |
Data Processing Details
Google Cloud Platform / Firebase
Services Used:
- Firebase Authentication (user sign-in)
- Cloud Firestore (database)
- Firebase Storage (file storage)
- Identity Platform (multi-tenant auth)
Data Processing Agreement: Available in Google Cloud Console
Security Certifications: SOC 1, SOC 2, SOC 3, ISO 27001, ISO 27017, ISO 27018
Privacy Information: https://cloud.google.com/privacy
Google Gemini API
Services Used:
- Generative AI for chat responses
- File search and retrieval
Data Processing:
- Content sent via API is NOT used for model training
- Covered under Google Cloud DPA
Privacy Information: https://ai.google.dev/terms
Google Cloud Translation
Services Used:
- Neural machine translation
- Automatic article translation
Data Processing:
- Text sent for translation is processed in real-time
- Covered under Google Cloud DPA
Privacy Information: https://cloud.google.com/translate/docs/data-usage
Upstash
Services Used:
- Vector database for semantic search embeddings
- Article search functionality
Data Processing:
- Stores mathematical representations (embeddings) of content
- Processes search queries for semantic similarity matching
- Does not store original text/images
Data Processing Agreement: Available on request
Privacy Information: https://upstash.com/trust
Vercel
Services Used:
- Web application hosting
- Edge functions
- CDN (Content Delivery Network)
Data Processing:
- Hosts application code and static assets
- Processes HTTP requests
Data Processing Agreement: Available for Pro/Enterprise plans
Security: SOC 2 Type II certified
Privacy Information: https://vercel.com/legal/privacy-policy
Image Embeddings (Local Processing)
Note: Image embeddings for visual search are generated locally on our servers using open-source CLIP models. No customer images are sent to any third-party AI service for embedding generation. The model weights are sourced from open-source repositories but all processing occurs on our own infrastructure.
Changes to Sub-processors
Notification of Changes
We will notify customers of sub-processor changes:
- New Sub-processor: At least 30 days before data processing begins
- Removal: Notification when sub-processor is no longer used
- Notification Method: Email to account administrators
Objection Process
If you object to a new sub-processor:
- Notify us in writing within 30 days of our notice
- We will work with you to address concerns
- If we cannot resolve the objection, you may terminate affected services
Data Transfer Safeguards
For transfers of personal data outside the European Economic Area:
| Mechanism | Sub-processors |
|---|---|
| Standard Contractual Clauses (SCCs) | Google, Upstash, Vercel |
| EU-US Data Privacy Framework | Where applicable |
| Data Processing Agreements | All sub-processors |
Contact
For questions about our sub-processors or to request copies of DPAs:
Email: privacy@heroworks.ai
Mail:
Smash Media Inc
53 Palmeras Street Suite 601
San Juan PR 00901-2410
Version History
| Version | Date | Changes |
|---|---|---|
| 1.0 | December 2025 | Initial version |