Subprocessors
The third-party processors that handle personal information on behalf of Cr8tivehub Digital Studios (Pty) Ltd.
1. Our Commitment
- We update this list before we onboard a new subprocessor that will process personal information.
- We provide at least 30 days' notice of any material change (a new subprocessor, a change of location, or a new category of data) by:
- Updating the “Last updated” date above;
- Posting an entry under “Recent changes” at the bottom of this page;
- For business customers (agencies under the Agency DPA), sending an email to the Authorised Representative.
- Where a subprocessor change creates an unacceptable risk for an agency customer, the agency may terminate the affected service on written notice within the 30-day window and receive a pro-rata refund of the unused prepaid period.
2. Current Subprocessors
Core platform infrastructure
| Subprocessor | Service | Data categories | Location | Safeguards |
|---|---|---|---|---|
| Google LLC (Firebase Authentication) | User authentication, session management | Email, hashed credentials, OAuth identifiers | europe-west1 (Belgium) | EU adequacy; Google SCCs |
| Google LLC (Cloud Firestore) | Primary database | Profile data, content metadata, billing records, settings, messages | europe-west1 (Belgium) | EU adequacy; Google SCCs |
| Google LLC (Cloud Storage for Firebase) | Portfolio media, ID-verification documents | User-generated content; verification documents | europe-west1 (Belgium) | EU adequacy; Google SCCs; encryption at rest |
| Google LLC (Cloud Functions) | Server-side compute for webhooks, moderation, jobs | All categories transiently | europe-west1 (Belgium) | EU adequacy; Google SCCs |
| Google LLC (Firebase Cloud Messaging) | Push notification delivery | FCM token, notification payload | Globally distributed | Google SCCs |
| Google LLC (Firebase App Check) | Abuse / bot protection on platform APIs | Device attestation tokens, IP address | Globally distributed | Google SCCs |
| Google LLC (Firebase Remote Config) | Feature flags and runtime configuration | None directly; user UID for cohort assignment | Globally distributed | Google SCCs |
| Google LLC (Firebase Crashlytics) | Crash and error reporting from the mobile app | Crash logs, device info, app version, installation ID | United States | Google SCCs |
Content moderation and identity verification
| Subprocessor | Service | Data categories | Location | Safeguards |
|---|---|---|---|---|
| Google LLC (Cloud Vision API) | Automated content moderation on uploaded images and video frames | Image content during scan; SafeSearch result returned | United States | Google SCCs |
| Google LLC (ML Kit — Face Detection) | On-device liveness detection during ID verification | Camera frames during the verification capture only — does not leave the device | On the user's device | N/A (no cross-border transfer) |
Live streaming and real-time
| Subprocessor | Service | Data categories | Location | Safeguards |
|---|---|---|---|---|
| LiveKit Inc. | Real-time audio/video streaming infrastructure | Audio/video stream content, room metadata, participant identifiers | United States | LiveKit SCCs |
Payments
| Subprocessor | Service | Data categories | Location | Safeguards |
|---|---|---|---|---|
| PayFast (Pty) Ltd | Subscription payment processing | Name, email, transaction amount, tier identifier. Payment card data does not touch Cr8tivehub systems — it is handled exclusively by PayFast. | South Africa | PCI DSS Level 1; POPIA §21 operator agreement |
Search and discovery
| Subprocessor | Service | Data categories | Location | Safeguards |
|---|---|---|---|---|
| Typesense (self-hosted or Typesense Cloud — finalise per environment) | Full-text search index | Profile fields, location, profession, hashtags | To be confirmed per environment | Self-hosted: in our own infrastructure. Cloud: under Typesense standard data-processing terms. |
| Subprocessor | Service | Data categories | Location | Safeguards |
|---|---|---|---|---|
| Twilio Inc. (SendGrid) | Transactional and marketing email delivery | Recipient email address, name, email content | United States | Twilio SCCs |
Security and abuse prevention
| Subprocessor | Service | Data categories | Location | Safeguards |
|---|---|---|---|---|
| Google LLC (reCAPTCHA Enterprise) | Bot and abuse detection on web forms | IP address, browser fingerprint, behavioural signals | United States | Google SCCs |
| Cloudflare Inc. (if used as CDN / WAF) | Content delivery, DDoS protection, bot management | IP address, request metadata, security challenge state | Globally distributed | Cloudflare SCCs |
Mobile-only
| Subprocessor | Service | Data categories | Location | Safeguards |
|---|---|---|---|---|
| Google LLC (Google Mobile Ads / AdMob) | In-app advertising on the mobile app, only for users without an ad-free subscription | Advertising ID (if opted in), device data, ad interaction events | United States | Google SCCs; AdMob consent SDK gates personalised ads |
3. Categorisation Under POPIA
For the purposes of POPIA, Cr8tivehub is the responsible party for the personal information of its users. The subprocessors above are operatorsunder section 21 of POPIA, processing on Cr8tivehub's behalf under written agreements.
Special-category data (biometric data — selfie and face-detection) is processed under section 27(1)(a) of POPIA (explicit consent), with the only subprocessors involved being:
- Google ML Kit (on-device, no transfer);
- Google Cloud Storage (encrypted storage of the selfie and ID document, in europe-west1).
4. Cross-Border Data Transfers
Where a subprocessor processes data outside the Republic of South Africa, the transfer is justified under section 72 of POPIA on the basis of one or more of:
- EU adequacy — recognised for transfers to Belgium (Firebase europe-west1).
- Standard Contractual Clauses — signed with Google, LiveKit, Twilio, Cloudflare.
- Consent — where applicable for specific user-initiated transfers (e.g. payment to PayFast).
Cr8tivehub maintains copies of the relevant transfer mechanisms and will make them available to the Information Regulator on request.
5. Recent Changes
| Date | Change | Reason |
|---|---|---|
| 2026-05-21 | Initial publication | First formal subprocessor list |
Future changes will be added to the top of this table with a 30-day prior-notification entry.
6. Contact
Privacy enquiries: legal@cr8tivehub.com
Subprocessor objections (agency customers): agency-support@cr8tivehub.com
Information Officer: Thokozani Dube — admin@cr8tivehub.com (registration 2026-011645)