A subprocessor is a company we use to run Nine, which therefore handles data for us. This page names all of them. Companies that are built into the code but not switched on are named separately, because a list that mixes the two is a list nobody can check.
Microsoft Clarity
How visitors use these pages, from Microsoft
Where you click and scroll, and how the pages behave, recorded without your name. Text you type into fields is masked. We use it only to make the pages better.
On every page
Railway
The servers the product runs on, in Railway's EU West region
Everything the product keeps: accounts, the files you send, jobs and the engine's working notes, finished films, and a cache of what was read from public websites.
Always
Vercel
Serves the pages and passes requests on to our servers
Ordinary web request data: your IP address, the page asked for, your user agent and the time. Requests pass through it on their way to our servers, files you upload included.
Every visit
OpenRouter
Connects our engine to the model that makes the film
What each step of making a film needs: your brief and your words, text read from your documents, a written copy of what is said in your recordings, your pictures and logos, pages from your website, the film as it is written, and pictures of it as it is made.
Every film the engine makes
Anthropic
Makes the model that researches, writes, builds and checks the film today (Claude). OpenRouter runs it at Anthropic, Amazon Web Services, Google Cloud or Microsoft Azure, and decides which for each call
The same material, passed on by OpenRouter.
Every film the engine makes
OpenAI
Makes the model the engine uses to search the web. OpenRouter runs it at OpenAI or Microsoft Azure
The search words the engine writes, such as your company's name. Not your files.
When the engine searches
Exa
Runs the web search when the model's own search cannot be used
The same search words. Not your files.
When the engine searches and the model's own search is not available
Cloudflare, R2
Private storage for finished films, held in Cloudflare's EU jurisdiction
The film file, in a private bucket for your account, from the time the film is made into a video file for you.
When a film is made into a video file
Resend
Your email address and the message: a sign in code, a note that a film is ready, or the note you asked for when you joined the waiting list. The waiting list, which is your email address, is kept there.
When we email you, and while you are on the waiting list
Domeneshop
Hosts our own mailbox, in Norway
Every message you write to us, and a note for each address that joins the waiting list, with what you wrote with it.
When you write to us or join the waiting list
Stripe
Payments
Card details and the payment, which never reach us. From us Stripe receives your email address and the name of your studio, so the payment is linked to your account. We receive that a payment was made, the amount and the currency, Stripe's reference for it, and the name, email address and country you gave Stripe.
When you pay
Companies Nine does not use, so none of them receives anything from you: Google and Apple (for signing in), ElevenLabs (a spoken voice), Deepgram (speech to text), Supabase (a hosted database), and Anthropic or DeepSeek, a company in China, reached directly rather than through OpenRouter. If Nine ever uses one of them, it is added to the subprocessor list first.
What none of them receive
- No model company receives anything when you type your web address on the front page. Our server reads your colours, typeface and name from your site itself, and no model is used for that.
- We do not train any model on your material, and we do not sell it or hand it to anyone to train on. Nothing in Nine trains a model, and no model weights are written anywhere, from your files or from anybody else's.
- Nobody but you and the email company sees a sign in code. It travels in the message to you, and it dies after ten minutes.
- Nobody receives your card details except the payment provider. Card data is entered on their side and never reaches Nine.
- Nobody receives a customer list. Nothing about you is sold.
Where the data goes
Our servers are rented from Railway, in its EU West region, and the films are made there. The private copy of a film at Cloudflare is held in Cloudflare's EU jurisdiction. The pages come from Vercel's network, which serves them from many places. Our mailbox is at Domeneshop, in Norway. OpenRouter, the companies whose models make the film, and Exa are in the United States, so what goes to them can be handled there.
On what basis data goes to the United States. Several of the companies named here are American, and what they receive can be handled in the United States. The law allows that on one of two grounds. On 10 July 2023 the European Commission decided that a company certified under the EU-U.S. Data Privacy Framework protects personal data well enough, so data can go to a certified company on that decision. Data that goes to a company that is not certified goes under the European Commission's standard contractual clauses, in our agreement with that company. OpenRouter's own privacy policy names those clauses. Write to us and we tell you which ground applies to each company, and send you a copy of the clauses.
How this list changes
When a company is added, changed or dropped, this list changes first, and the date on it changes too. If you are a business customer and want to be told before a change, write to Sondre@NorwAI.as with subprocessors in the subject line. We give 30 days notice before a new company starts handling data for us.
The privacy page says the same in more words.