The services we use, the data they receive and their storage rules. Specialist media analysis is described by recipient category.
International processing
Código Solidário Lda confirmed the marked service arrangements on 7 September 2026. This is the operator’s confirmation, not an independent certification. Some providers process data outside the EU under the applicable agreements and transfer safeguards. The entries below explain each service’s storage and human-review terms.
This public overview is not a complete named subprocessor register. Your company account lists current legal entities, processing locations and applicable terms.
Site code; requests and network data; account and report records; temporary scan objects; opted-in research files; operational logs.
Location / transfer
Global network and service-specific storage locations. Data is not limited to the EU.
Storage and further use
Log, backup and recovery periods depend on the Cloudflare service and account settings. No single retention period is stated here for the whole hosting stack.
External image and audio analysis service
Image and audio · confirmed by operator
Purpose
Audio checks and image checks when this provider is selected.
Data
Submitted file, original filename and technical metadata; some requests use an unguessable temporary transfer URL.
Location / transfer
United States and other locations covered by the account’s transfer terms.
Storage and further use
Files, results, logs and backups follow the account agreement; no fixed account-specific period is stated here. This service’s standard terms may allow human review and service improvement unless excluded in writing. Use is subject to the acceptable-use rules, including restrictions on sensitive content.
Reality Defender, Inc.
Backup analysis · confirmed by operator
Purpose
Backup image and audio checks if the primary service is unavailable or unsuitable.
Data
Complete submitted file, filename and technical metadata uploaded through a provider-issued storage URL.
Location / transfer
Provider and subprocessor locations covered by the account agreement. EU-only processing is not promised.
Storage and further use
Files, results, logs and backups follow the account agreement. No fixed account-specific period is stated here.
External image and video analysis service
Image and video analysis
Purpose
Checks supported images, video and video audio.
Data
Complete image or video, filename, content type and derived result.
Location / transfer
Locations and transfer safeguards follow the account agreement. EU-only processing is not promised.
Storage and further use
The provider says it deletes checked media after analysis. Its agreement governs logs, derived data, backups and any further use; that deletion statement does not cover every type of record.
Pangram Labs, Inc.
Text · confirmed by operator
Purpose
AI-text checks for pasted text and text extracted from documents or public webpages.
Data
Text and limited source context. For document imports, only the selected extracted text or sample is sent for this text check; the original document is not sent to the text service.
Location / transfer
Default hosting is in the United States. Custom hosting and zero-retention arrangements apply only if included in the account agreement.
Storage and further use
Text, usage logs and backups follow the account agreement. No fixed account-specific period is stated here. Turning off public dashboard links does not itself delete these records.
OpenAI Ireland Ltd / applicable OpenAI entity
Visual review, comparison and research · no training by default
Purpose
Additional visual review for personal and Full business image checks, business evidence comparison, and optional source research.
Data
Image review uses a server-generated reduced preview. Business evidence comparison sends complete submitted images and PDFs, filenames, readable PDF text, descriptions and requested comparison fields; it does not use web search. Research can send extracted text, signed detector findings, source names or URLs and search instructions. Video investigation does not send browser-generated frames.
Location / transfer
Global API endpoint; EU-only processing is not promised. Applicable data-processing and transfer terms cover the service.
Storage and further use
We disable response storage with store:false. Standard abuse-monitoring records may still remain for up to 30 days unless an approved zero-retention or modified-monitoring arrangement applies.
Plus Five Five, Inc. (Resend)
Account email
Purpose
Account emails, including verification and password resets.
Data
Recipient, sender, subject, message body, delivery metadata and a time-limited verification or reset link.
Location / transfer
Principal storage in the United States. An Ireland sending region affects routing, not all account or log storage.
Storage and further use
Standard plans keep email data for 30 days; Enterprise settings may differ. Resend’s DPA provides for deletion of customer and user data within 90 days after account termination. A separate backup period is not stated here.
Google LLC / Google Ireland Ltd · Analytics
Analytics · only after consent
Purpose
Optional website and product measurement after analytics consent. Google Ads measurement of visits and selected business events requires a separate advertising-measurement choice; personalised advertising stays off.
Data
Device/browser information, a pseudonymous browser identifier, IP-derived network data, page path, campaign parameters and selected product events. With separate advertising-measurement consent, ad click identifiers and selected business events may be linked in Google Ads. We do not send submitted media, report contents or hashed contact details.
Location / transfer
Google global infrastructure with its applicable contractual transfer safeguards.
Storage and further use
Google Analytics offers two- or 14-month event/user retention. Aggregated reports may remain longer. This page does not state a verified property-specific setting.
Other companies and destinations
Some companies also decide how to use data for their own purposes. Other destinations, such as a website or webhook, are chosen by you.
Recipient
When data is shared
How the data is handled
Stripe contracting entity and payment partners
Checkout, invoices, payment methods, subscriptions and fraud prevention. Stripe receives your billing details when you use a payment flow.
The applicable Stripe entity, locations and safeguards are shown in Stripe’s terms and at checkout.
Microsoft Ireland Operations Ltd / Microsoft group · Clarity
Only after analytics consent and only on allowlisted public marketing, information and trust pages.
Independent controller under Clarity terms. Session playback is retained for 30 days; aggregate, heatmap and selected session data may remain up to 9 months. It is excluded from scanner, result, authentication, account and admin routes.
Google Ireland Ltd / Google LLC · Sign in with Google
Only when the user selects Google sign-in; DeepfakePolicy receives a subject identifier, verified email and display name.
Independent identity provider under Google’s privacy terms.
Proton AG
When a person emails the published support/privacy mailbox.
Communications provider receiving the sender address, message and attachments selected by the sender.
User-selected public website
When a user asks DeepfakePolicy to retrieve a public URL for analysis.
The destination receives a server request. It is selected by the user and is not appointed by DeepfakePolicy.
Customer-configured webhook destination
When an organisation enables Evidence API delivery.
Receives the report on that organisation’s instruction; the destination and its copy are controlled by the organisation.
Our detector research
Our system evaluates model updates separately from your report. Before using a new model host, we review its data handling, storage, access and training terms.
Provider updates
Business customers receive provider-change notices at the privacy email recorded with their agreement. To update that contact, email deepfakepolicy@proton.me with your company name and privacy contact.