Legal
Subprocessors
The third-party providers that process personal data for Laya Studio, what each one receives, and where.
Last updated ·
1. Providers that can receive request content
These providers can process the content of API requests, which we handle as your processor under the Data Processing Agreement.
| Provider | Purpose | Data | Location | When |
|---|---|---|---|---|
| Cloudflare, Inc. (USA) | Hosting of the website, dashboard and API gateway (Workers), DNS, TLS, DDoS protection, rate limiting, the encrypted tunnel to our Swiss GPU server, and the usage-metering queue. | All traffic in transit, including request content (passed through, not stored); IP addresses and technical logs (kept a few days); usage metadata while it is queued for billing. | Cloudflare’s global network (the data centre nearest the caller) | Always |
| RunPod, Inc. (USA) | Failover GPU inference when our Swiss GPU server is unavailable or overloaded. | Request content, processed in memory and not stored. | EU/EEA data centres: Czech Republic, France, Netherlands, Romania, Sweden, Iceland, Norway | Only when failover is enabled and needed; never for Swiss-only workspaces or requests |
| phi-cloud | Language-model API gateway used by the chat agent to plan questions. | Chat-agent prompts and the planned questions. | Routes to the model providers below | Only for POST /v1/ask, the MCP ask tool and dashboard Chat |
| Inception Labs, Inc. (USA), via phi-cloud | Mercury language model for chat-agent planning. | Chat-agent prompts. | United States | Chat agent, when Swiss-only mode is off |
| Infomaniak Network SA (Switzerland), via phi-cloud | Swiss-hosted language model for chat-agent planning. | Chat-agent prompts. | Switzerland | Chat agent, when Swiss-only mode is on |
2. Providers for account, billing and email
These providers process account and billing data, for which we are the controller (see the Privacy Policy).
| Provider | Purpose | Data | Location | When |
|---|---|---|---|---|
| Supabase, Inc. (USA), on Amazon Web Services | Authentication and the account database. | Account data, sign-in records (including IP address), hashed API keys, credit balances and ledger, request metadata and usage totals. | Switzerland (AWS Zurich region, eu-central-2) | Always |
| Stripe (Stripe, Inc., USA / Stripe Payments Europe, Ltd., Ireland) | Payments, subscriptions, invoices and tax calculation. Stripe also acts as an independent controller for payment processing and fraud prevention. | Name, email, billing address, tax ID, payment details (entered directly with Stripe) and purchase history. | United States, EU and other Stripe locations | When you buy credits or subscribe |
| Resend (Plus Five Five, Inc., USA) | Delivery of transactional email (sign-in and account emails). | Email address and email content. | United States | When we email you |
| Google (Google LLC, USA / Google Ireland Ltd.) | Sign in with Google. Google acts as an independent controller. | Your Google account identifier, name and email address, and the fact that you signed in. | Google’s global infrastructure | Only if you choose to sign in with Google |
3. Safeguards
Each provider is bound by data processing terms. Transfers to countries without an adequacy decision rely on the EU-U.S. / Swiss-U.S. Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses with the adaptations required for Swiss law.
4. Changes and notifications
We update this page and the date above whenever the list changes, and email workspace owners at least 30 days before a new subprocessor starts receiving customer content. To object to a change, email privacy@laya.studio; see §6 of the DPA.