Launch policy set
Service Providers & Subprocessors
Named providers, purposes, data types, and whether production use has been approved.Version 2026-07-22.launch-candidate-v2 · Effective 22 July 2026This policy applies to the public preview from its effective date. Paid-service terms become binding only when this exact version is shown and affirmatively accepted at checkout. Ozelaro is not yet accepting paid orders, and mandatory statutory rights always take priority.
Current public-preview providers
- OpenAI — Ozelaro Guide and text-only AI generation. Prompt/response data and safety identifiers. API response storage is disabled by Ozelaro; default provider abuse-monitoring retention may still apply. Production customer-content terms and transfer settings require final verification.
- Cloudflare-backed Sites infrastructure — site delivery, application runtime, D1 database, R2 object storage, security and request metadata. Production account/media region, contracting chain, and data-processing terms require final verification.
- Hostinger — ozelaro.tech DNS and hi@ozelaro.tech email. Contact messages and ordinary mail metadata/content are processed under the configured mailbox service.
Planned paid-service providers — not yet approved for production
- Stripe — checkout, subscription billing, tax/billing references, fraud controls, refunds, and customer portal. Stripe may act as processor and independent controller for different purposes. Live merchant and webhook verification is incomplete.
- ElevenLabs — guided voice sample, voice-profile creation, approved narration text, generated audio, and deletion requests. Commercial/OEM permission, DPA, transfer, retention, and deletion verification are incomplete.
- Google/YouTube, Meta/Facebook/Instagram, TikTok, and LinkedIn — only the identifiers, OAuth scopes, upload media, metadata, schedule, and receipts needed for destinations the customer explicitly connects. Each platform's app review and production approval is separate and incomplete until recorded.
Launch rule and changes
A provider marked incomplete above must not receive production customer media, voice data, billing data, or live publishing authority merely because code for the integration exists. Activation requires a recorded vendor review, correct agreement and transfer mechanism, scoped secrets, deletion path, security controls, and a successful isolated test.
Material subprocessor changes will be posted here and, for customer-controlled personal data, notified under the Data Processing Addendum. Connected social platforms are selected by the customer and often act as independent controllers after publication.
Email hi@ozelaro.tech.