Subprocessors List

Effective Date: October 16, 2026

1. Overview

CreatoRain (operated by Midwest AI Solution Inc.) uses certain third-party service providers ("subprocessors") to assist in delivering our restaurant influencer marketing platform and related services. These subprocessors may process personal data on our behalf in accordance with our instructions and applicable data protection agreements.

This page lists each provider that currently processes personal data for CreatoRain's services, what it does, and where it is based. Where a provider is based is not always where it processes data: unless an entry says where data is processed, a provider may process it in any country where it operates. Section 5 describes the checks we make before adding one.

2. Current Subprocessors

Infrastructure and Hosting

  • Amazon Web Services (AWS) — Hosting, databases, file storage, sign-in, and email and text-message delivery — United States
  • Cloudflare — Domain name system (DNS) hosting — United States
  • Sentry — Error monitoring; receives error messages and technical details when something fails, which can include personal information — United States

AI Models

  • Google (Gemini API) — AI models used to find and match creators, read replies, and draft campaign messages; also answers questions in the website help chat — United States
  • DeepSeek — Writes campaign emails and replies, checks AI-drafted replies before they are sent, and helps find and match creators; also a backup for our other AI features — China (data is processed in the People's Republic of China)
  • OpenAI — Backup AI model, used automatically if our other AI models fail — United States
  • Anthropic — AI model behind software tools our staff use; can also be switched on for our AI features — United States

Creator Data, Websites, and Email Checks

  • Bright Data — Collects the public social media profiles of creators — Israel
  • influencers.club — Supplies creator profiles for our creator search: name, username, profile picture, and follower and engagement counts, with no email addresses. When we search it by location or gender, we record the location and gender a creator matched as that creator's likely location and gender — Estonia (data is hosted in the European Union)
  • Zyte — Loads restaurant and business websites for us, which can include owners' names and contact details — Ireland
  • ZeroBounce — Checks that creator and business email addresses can receive mail — United States
  • Postmark (ActiveCampaign) — Checks outgoing campaign emails for spam signals before they are sent — United States

Messaging and Meetings

  • Claw Messenger — Sends and receives our text messages (SMS, iMessage, and RCS) — United States
  • Fireflies — Records and transcribes video meetings with us and summarizes them — United States
  • Tencent (WeChat) — Carries the messages you send us on WeChat — China (data is processed in the People's Republic of China)

Postal Mail

  • PostGrid — Prints and mails the postcards our campaigns send; receives each recipient's name, business name, and postal address, the sender's return address, and the text printed on the card — Canada

Office Tools, Fonts, and Images

  • Google (Workspace, Fonts, and Firebase Storage) — Staff email and calendar, our demo booking page, our website's typeface, and images in our emails; receives the IP address of anyone who loads that typeface or those images — United States
  • Atlassian (Jira) — Our issue tracker; tickets can hold customers' and leads' names and email addresses — Australia
  • ImgBB — Hosts an image in our sign-up and verification emails; receives the IP address of whoever opens them — Location not published by the provider
  • Pexels — Stock photos on our website's city guides and blog; receives visitors' IP addresses — Germany

Payment Processing

  • Stripe — Payment processing, subscription billing, and financial transaction management — United States

3. Subscribing to Changes

CreatoRain emails the account administrator of every client at least thirty (30) days before a new subprocessor begins processing personal data, and updates this page at the same time.

Anyone else who wants the same notice can subscribe by emailing privacy@creatorain.com with the subject line "Subscribe to Subprocessor Updates."

4. Objection Process

If you have a legitimate concern about a new subprocessor's ability to adequately protect personal data, you may object to the addition of a new subprocessor by following the process outlined below:

  • CreatoRain gives at least 30 days of notice, as Section 3 describes, before a new subprocessor begins processing personal data
  • You may submit a written objection to privacy@creatorain.com within 30 days of receiving the notification
  • Your objection must include the specific reasons for your concern, including any data protection or compliance issues
  • CreatoRain will review your objection in good faith and engage in a dialogue to address your concerns
  • If CreatoRain is unable to resolve your objection to your reasonable satisfaction, you may terminate the affected services in accordance with your Client Agreement without penalty
  • During the objection period, CreatoRain will not authorize the new subprocessor to process your personal data

5. Due Diligence Process

Before engaging a new subprocessor, CreatoRain checks:

  • That it publishes its security certifications or measures (for example, SOC 2 or ISO 27001)
  • That it offers a data processing agreement
  • How any cross-border data transfer is covered (for example, by Standard Contractual Clauses)

6. Contact Information

If you have questions about our subprocessors or wish to exercise your rights regarding subprocessor changes, please contact us: